You could have a bridge (e.g. with an IDS or a packet filter) with a management interface on a separate VLAN, or which requires management via a physical cable

You could have a bridge (e.g. with an IDS or a packet filter) with a management interface on a separate VLAN, or which requires management via a physical cable of some sort. But the bridge could also intercept traffic to port 22 and redirect it to itself. Personally, I resort to Wireguard instead being the only reachable port.