I quite like Tailscale SSH for this, but I don’t have as many machines, so not sure how it will scale. You can definitely assign roles here to allow/deny SSH between hosts in your fleet though.

Did you try manually setting the TDP? In Civ VI I set it to 7W (default graphics) and it has helped quite a bit.