Address the bereaved by first name if you are on a first-name basis when you do business. Use the appropriate honorific and surname if you normally do so when you are face to face. Sudden formality or familiarity is out of place.
Open with a remark that acknowledges the death. Say something akin to, "I just learned of your tragic loss ... ."
Continue with an expression of sympathy, but avoid unfeeling pseudo-sentiments that sound as if you looked up condolence letters in a book on corporate etiquette. For example, you've probably seen "We wish to extend our condolences to you at this time of your loss" many times before. At the same time, avoid cliches such as "He's in a better place" or flowery phrasing that ultimately ends up sounding unnatural and as manufactured as a corporate letter. Flowery phrasing will also step beyond professional boundaries.
Strike a balance that is both sincere and professional. You might establish a conversational but not overly friendly tone rather than resorting to the formal tone of a corporate letter. A simple remark or two is enough; for instance, "Our hearts go out to you and your family." Think of the conversational tone that you might strike while waiting for a business meeting to start. Know your limits and stay within the boundaries of good taste, but let your colleagues see you as human.
Briefly mention meeting the deceased, if you did. Add one or two short sentences, such as "I met Sandy at the company picnic last summer. She was a lovely, sincere human being."
Sign off with another simple, short remark such as "We wish you comfort and peace in time." Keeping everything short will prevent you from becoming overly familiar or inappropriately emotional.
Avoid religious references. The bereaved may not share your views on the afterlife, and again, you may be overstepping professional boundaries.