Realistically, you would use a SPI controller and a small state machine. The SPI controller might even be one that was designed to be used by a microcontroller. That is up to how much time you want to put into finding a SPI controller that matches your exact requirements vs how much time you want to spend writing your FSM to a controllers requirements vs how much time you want to put into re-writing/verifying a SPI controller. There might be some area/performance differences, but SPI controllers should be fairly small.
At that point, you'd have a state machine with an idle state, one or more "read from SPI" states, zero or more "validate and output" states, and 1-2 states for increment and loop termination check. For example, a uC based SPI controller might use a FSM with a "write address register", "write data register", "write control register", "write status register", "read status register", "status polling loop", "read data register" flow.
if the SPI controller has interrupts, these might be more useful. Also, depending on the interface, you might have multiple states for "read/write * register".