If you want that, I'd personally suggest wireguard. Bind sshd to the wg interface and it'll be invisible.