From web ui, System, Setup, ssh, you can declare from which interfaces (and which ip addresses) is allowed the ss management, once you declare a rule, an implicit ‘deny any’ is added at the end.
So, you may allow the management from the internal lans (or ip addresses) then add rules for wan interface and your IP Addresses Blocks.
Regards