If you need a management vlan, make one. Wireguard interfaces are _cheap and easy_ - there's no reason not to set up an interface for normal client traffic tha

If you need a management vlan, make one. Wireguard interfaces are _cheap and easy_ - there's no reason not to set up an interface for normal client traffic that sshd doesn't listen on, and an interface for just sshd with different ACLs and routing logic if you want.