In my case, I have the following setup:
- "Accept SSH traffic from all interfaces" option is unchecked
- Packet filter that explicitly allows SSH traffic from the Internal interface
I verified that I'm unable to connect via SSH from outside my network, so this appears to be the equivalent of what you described. Would you agree?