How can I block ssh brute force attempts in OS X 10.11?

I've been researching opening up SSH like this on other *nix based systems, and most suggest two things. I'm sorry but I don't know how to do either on MacOS.

  • Fail2Ban - Which bans IPs that have too many failed login attempts
  • key rather than password based SSH logins. I believe you can take your key around with you if you want to use public machines.