Secure and harden SSH Bastion host?

Secure and harden SSH Bastion host?   1. Enable a firewall and by default block all  IP access to the SSH Port and enable only your staff ips or dynamic ip ranges that you trust. 2. Disable direct root login. Its always better to login as a non privileged user first and the switch to