Not using default ports will mildly confuse automated scans and do absolutely nothing to a determined attacker. Or somebody with nmap, which is not the same thing.
If you're whitelisting IPs, you may as well run it on port 22.
If you're whitelisting IPs, you may as well run it on port 22.
Color me skeptical. I shall decline to "trust you."
Sterling work establishing your own competence there.