Thanks for your comments.
On the MX all IP's for each interface are public, and I am able to SSH to each IP.
set policy-options prefix-list dos-ssh-protect X.X.X.X/32
set policy-options prefix-list dos-ssh-protect XXXX::X/128
....all IP's associated with MX....
set firewall family inet filter DOS-Protect term deny-ssh-protect from port ssh destination-address prefix-list dos-ssh-protect
set firewall family inet filter DOS-Protect term deny-ssh-protect then discard
set firewall family inet filter DOS-Protect then accept
set interface X family inet filter input DOS-Protect
....all interfaces with public IP associated with MX....
><><><><>><><><><><><><><><><><><><><><><><><>
Would you class the above as best practice?