Grist has access rules which give the document owners the ability to set rules that limit who can see or edit what, down to each table, column, or cell. Rules can be based on user attributes, including attributes defined by the document owner (e.g. roles within a company), and based on values in cells (e.g. if a row's boolean field is true or false).
On the document thing - this is still a little tricky, as e.g. IT should probably be in charge of assigning permissions, but they shouldn't be able to see salaries.
Here's a strong form to help threat model: are you warrant-proof?
If authorities demand customer data, can you give it to them?
In general, if the answer is yes, then not just the government warrants but your own insider threat is also a threat to your customers.
It may be that self-managed hosting is your answer, with the inevitable "call us" pricing: https://www.getgrist.com/product/self-managed/
But as most companies will be putting data in a spreadsheet that has laws around it whether they consider themselves "regulated" or not, all firms should be interested in the warrant-proof answer.