Asking how to secure ssh opens a can of worms, here are those worms.
Some will be mad when I say this, but it's something fairly simple that can be accomplished and "should have been built this way" a long time ago.
This can be done, most who disagree are neighsayers, and likely responsible for the vulnerabilities we currently face in the world...I digress.
The above suggestion of forcing all traffic through proxies that require visibility into the traffic before handing off is a strong start and should be a concept deployed on top of and aligned with your network and physical security policies and methodologies, sometimes down to the security guard's laptop/mobile doing hall duty.
Control your client workstations. Wire them appropriately. Segregate from wireless. Have constant stat monitoring on client "dumb terminals." Usb turned off. Provide power hubs for the individuals needing power. Have all exports leave through a approval process, which includes IT admin procedures.
Software on these workstations can be a simple platform with minimal ability that provides a web interface or client application that will securely guide them to accessible resources that are only appropriate to their role.
Wireless should be avoided unless on a completely different trunk altogether.
Services like "social media platforms" should be "overscrutinized" as they're should be more false alerts than actual alerts, so that the company can benefit from the information going in and out of a social media network being "utilized."
All of this is from a low level support agent with way too much time on their hands. However, if you have a network with these methodologies deployed, you will attest it is valuable to know the comings and goings of your employees, not an invasion of privacy, but an asset. At your place of secure data, the only thing anyone should have to hide is the company and its data, including who handles it and how.
In this day and age, if you have a reason for information assurance, you need assurance in those people assuring to provide secure information.
No need for employees to be moving company data around as freely as they do these days.
This can all be greatly mitigated at the minimum, let alone enforced with physical security protocols as well to limit the photography and video aspects of data exfil methods in addition to usual pen and paper, "killer usb drives," etc.