I am thinking it is better to block all incoming connection by default and ask user if SSH should be allowed.