Your goal is to protect SSH, not the VPN network. The VPN network is just a tool for protecting SSH. With your configuration, all that needs to exist is an SSH

Your goal is to protect SSH, not the VPN network. The VPN network is just a tool for protecting SSH. With your configuration, all that needs to exist is an SSH 0 day to gain access to the server. With a VPN, they need that AND a 0 day for the VPN software to gain access to the server. You can have a more complex setup with a VPN, but that isn't the discussion here - the discussion is securing SSH. If you want to provide VPN access to an array of other services, or as access to a corporate LAN or similar, then that's another conversation that has to involve the specifics of those services and that configuration. It's not what is being recommended here.