Comment by steffan

Even if you don’t have a static IP, you can probably restrict to a /24 subnet or maybe /16.

Additionally, you can ensure password access is disabled and use ssh keys along with 2FA.