2- For example HTTP Basic Auth is easily bypassable, is the same also for SSH Login, or this isn’t bypassable if you don’t know user and password?
Not sure why you mean it's bypassable. It certainly doesn't need to be. Assuming you are using a secure layer like HTTPS (so credentials aren't sent in the clear), a good implementation could be secure. Devices like ip cameras often don't have good and secure implementations, though, so it's wise not to expose them directly.
In contrast, ssh servers are generally very well implemented, and thus are unlikely to have vulnerabilities like those often found in those IoT devices.
With no vulnerabilities, the only way to log in would be to know (or successfully guess!) the user and password. Note that with SSH, you could disable passwords and connect using a ssh key (that's akin to using a client certificate with HTTPS, although not something I have seen any ip camera to support).
1- To create SSH tunnel is necessary to open port 22 on router in which is connected the camera?
You will need to open the port the user connects to. SSH is often placed on port 22, but you could choose to place it at any other port number if so you wish.
Please note that you need a ssh server to connect to. The camera probably doesn't include that, so you may need another computer that you will proxy through, or perhaps you want to connect through the router, which need to be secure itself.
If yes, is there risks by opening port 22?
You are exposing a system that wasn't previously exposed on the internet. In case someone got access to the system providing the ssh service, they would get more than if they just got access to the ip camera.
Can hackers exploit?
It will depend if the implementation used has vulnerabilities that could be exploited.