/etc/ssh/sshd_config.d/50-cloud-init.conf

# Globally deny logon via password, only allow SSH-key login.  
PasswordAuthentication no
PermitRootLogin no
PermitEmptyPasswords no
ChallengeResponseAuthentication no

# But allow connections from the LAN to use passwords.  
Match Address 192.168.1.0/24
  PasswordAuthentication yes