Leave the default sshd alone. If ssh is not necessary in default VRF, another role should disable it.
With sshd in separate management VRF and FRR to announce routes to self over unnumbered BGP.