Well, it will depends on how your environment works. This is difficult to give you a direction whithout knowing you network. I´ll tell you how my environment works. We have an unique network for management and our devices has one interface (loopback or int vlan) on this nework. Then we have firewall filtering who (network) can get access to this mgmt network and of course, TACACS.
We have VRF everywhere, so, one VRF is dadicated to carrie management traffic from site to Data Center. VRF is really nice as it segregates traffic from the begining to the end.
On the mgmt network you can allow only HTTPS, TACACS, Syslog, SSH and others mgmt protocols and dont give access to the internet from this mgmt network.
We also use some kind of VDI to get access using HTTPS or SSH. This way, the connection doesn´t start from admin machine but from a controlled environment. The admin machine serves only as a terminal to access this VDI environment.
This can go on and on depending on how complex is your environment and how secure you want to be.
