Not necessarily. You can have one or several (potentially load-balances) “gateways” which act as entrypoints into subnets.

At some point you’ll probably want to integrate with some identity management , but dozens of users and hundreds of servers are totally fine to manage as yaml in ansible IME.