You could do so by using the attribute accept and adding allowed mime-types to it. But not all browsers do respect that attribute and it could easily be removed via some code inspector. So in either case you need to check the file type on the server side (your second question).
Example:
<input type="file" name="upload" accept="application/pdf,application/vnd.ms-excel" />
To your third question “And when I click the files (PDF/XLS) on webpage it automatically should open.”:
You can’t achieve that. How a PDF or XLS is opened on the client machine is set by the user.