I’m not really knowledgeable about it, but there is an article from Tailscale that explains how they use SSH (basically it creates a separate SSH server specifically for Tailnet traffic). From what I understand, this feature is relatively new.

You may also want to look into Tailnet lock.