You don't really need a firewall to do that. putting

  ListenAddress 100.x.x.x

where 100.x.x.x is the address on the tailnet, into your sshd_config would do what you want. Unfortunately you can't specify an interface, but if you have any sort of automation in place this is easy enough to template in.