"In general for ISP facing interfaces you should have an inbound access list blocking more than just SSH."
Yup, in fact, I'm an advocate of denying ALL external ingress traffic to Internet "visible" interfaces' IPs, possibly also additional same device or further in device IPs too (such as the device's internal facing or loopback interface IPs - remember this ACL is against traffic entering from outside your network), and then add permits as required. (BTW, to be clear, this ACL would be "in" on your most external facing interface connecting to the Internet.)
Understand this doesn't control traffic transiting though the interface, just traffic to interfaces' IPs, which often, from the outside, there's limited need.
For the cases where external traffic really does need external access to interfaces' IPs, e.g. tunnels, BGP, your permit ACL's ACEs can be very restrictive, such as such traffic must have a known good source IP and/or the protocol being used.
The above approach just provides an often easy to manage ACL that provide an initial access barrier. Other security hardening best practices should be considered. (I recall [?] Cisco has some recommendations along those lines on their main site.)
