Just use a jump server and put the rest of your servers on the private subnet for port 22 inbound. Expose your jump server to your vpn only and use 2fa on vpn.