The tunnel removes inbound ports, but every hostname in ingress is still publicly resolvable and reachable. Access policies, not the tunnel, are what make a service private.
Setting PasswordAuthentication no is not sufficient. With UsePAM yes and KbdInteractiveAuthentication left at default, sshd will still complete a keyboard-interactive password login.