I also try and isolate the server itself and only open the VMs to external connections
Very cool idea! I do not have any expertise here so I am unable to share any best practices on that one.
I've heard its a good practice to disable remote root login
Yes it is a good practice unless you need root. It's all use case in this matter.
Do you use 2FA if so what mehtod have you setup?
I have not used 2FA on my servers yet but it's a great feature for sure.
I'll post some tutorials based on what I do if you want to add them to a future post then!