Put VM into "Protected Mode" by ticking an option from creation panel.
So, default port 22 (SSH) would only accept connection from localhost or console log and can only disabled on vm panel setting after creation process completed.
Most of OS template doesn't have Fail2ban service installed by default.
I suggest this because after installed the fail2ban service, it's detect many failure signin attempt from ssh port, mostly from China region, thank you.