You can restrict SSH commands by having it serve a restricted shell instead of arbitrary shell. Like how there's games where you can SSH into server to play

https://crawl.develz.org/wordpress/howto#connecting