This depends on your firewall solution. What you are talking about sounds like Layer 7 Content Filtering. This is not as common as Layer 3 IP filtering but is supported on some more advanced firewalls.
To address your question of being able to differentiate between connections to the same IP but different hostnames:
This is very easy to do with websites as the hostname is transmitted in the HTTP header and can be easily identified by the firewall. If you want to do this with SSL/TLS you will get a certificate error unless the proper CA is installed on the client, this is because the firewall needs to act as a Man-In-The-Middle to decrypt, inspect, and re-encrypt the data in order to see the hostname.
If you were wanting this functionality for other services, such as SSH as you suggested, this is much more complex. There are no headers or any other indications of a hostname in many other protocols such as SSH. Some advanced firewalls may offer enough configuration flexibility to help address this, but it wouldn't be a fool proof solution. This would likely be done on the DNS level and either serve a bad IP for the banned hostname, or block the IP after a DNS request was made for banned hostname.
Edit: After re-reading your question, I am not sure why I assumed you were talking about outbound filtering. If you are talking about inbound filtering, then the last bit about DNS doesn't really apply.