Fail2ban? sshguard? unnecessary.
Just disable ssh passwd auth (which generally is a good idea) -> done/done
If you don't like lognoise from ssh scanners (even if you disable passwd auth), move your sshd port to some random high port and make note of it in your ~/.ssh/config
Generally: if in doubt, take the more simple and elegant solution to a problem.