dont turn on ssh to the public, open it to select ips or ranges

What if you don’t have a static IP, do you ask your ISP in what range their public addresses fall?

I don’t understand. You will still need to do administrative tasks once in a while so it isn’t really unnecessary, and if root can’t be logged in, that will mean you will have to use sudo instead, which could be an attack vector just as su.