I'm a fan of the VPN terminator as jump point approach. OpenVPN with tls-auth switched on is a pretty robust front door. If you combine that with enforced key

I'm a fan of the VPN terminator as jump point approach. OpenVPN with tls-auth switched on is a pretty robust front door. If you combine that with enforced key only auth for ssh, ensure all internal machines run their own firewall and logically split different bits of your internal network off in to their own subnets you've got a fairly secure foundation to build upon. Another easy win is switching internal services over to TLS/SSL only (where it makes sense/is possible to do so).