As a long term Linux user I highly recommend the Universal Blue (immutable Fedora) spins. It’s been rock solid on my desktop and 10x better on a laptop I thought was a lemon because Ubuntu would crash or do other weird things about once a week. The immutableness hasn’t really caused me a lot of grief except when I tried to connect my 15yo printer (I just relented and got a new printer) when I had to go through a distrobox.

In addition to other advice you could also use SSH over Wireguard. Wireguard basically makes the open port invisible. If you don’t provide the proper key upfront you get no response. To an attacker the port might as well be closed.

Here’s at least one article on the subject: https://rair.dev/wireguard-ssh/