A threat model that does not fit in one sentence is not a threat model
Every threat model I have seen die started the same way: as a workshop with sixteen people, a whiteboard, and a template with columns nobody agreed on. Three weeks later there is a document. Nobody opens it again.
The ones that survive start as a sentence:
An unauthenticated person on the internet should not be able to read another tenant’s data.
That sentence does the work. It names the attacker, the capability and the thing you actually care about. Every control you build after that is either serving the sentence or it is not, and now you can tell which.
The spreadsheet is fine. Write the sentence first, then let the spreadsheet explain how you hold it up. If a row does not connect back to a sentence, you found something to delete.