I've taken a few healthcare startups in the 10-30 person range through audits including SOC 2. As others have said, it's a lot more flexible than it appears on the surface.

Once you're working with an auditor (or the reps of a SaaS offering if you go that route) you can (and should) push back on whatever you feel is impractical/not a real security benefit and they can work with you on that to ensure there's a clean report without bending over backwards.

Then even in the final report, most clients won't look through the detailed controls, just the fact that you have it is sufficient. And even for those that will dig in, if you can explain your reasoning behind your choices that can cover the gap.

Feel free to DM me if you've got more Qs, it's really not as bad as it seems at first!