@ekevu123 said:

no public access whatsoever is needed

At least a health check path needs to be "exposed" for the app.

@ekevu123 said:

I was thinking of restricting access only via Cloudron's VPN app, how would I implement this?

With Cloudron 10 you can simply enable VPN protection for an app in the Access settings of the app.
But that only protects the http/s access, not exposed ports.
So if you app exposed e.g.: port 2022 as the SSH port that will still be accessible publicly even with the VPN protection enabled.

@ekevu123 said:

think about heightened security

Only allowing ssh key based auth and no passwords for sure.
Also enforcing 2FA on SSH keys might also be an option to make it even more secure.

@ekevu123 said:

The goal is to allow SSH access only

One idea that could also help although a little security via obscurity and with the VPN protection of the app.
Hide the SSH daemon behind a NGINX inside the Cloudron app.
This way the only port exposed from the app is e.g.: 8080 => Cloudron NGINX 443 and could even serve a static HTML that can be used for health check in the manifest and also be a "honey pot" so it looks like just a website.
But when you connect to the domain with port 443 with SSH the NGINX will just route/stream that to the ssh daemon.
I am not 100% sure if that is possible with the Cloudron default NGINX setup.
That would need some testing.