Highly recommend getting a router that can accept wireguard connections. If the router goes down you’re not accessing anything anyways.

Then always put ssh behind the wireguard connections.

For a homelab, there is rarely a need to expose ssh directly so best practice will always be to have multi layered security when possible.