I want to protect SSH access to our live web server from all IP's except our office static IP.

There are some employees who connects to this live server from their dynamic IP's.
So, it is not always possible for me to change in the iptables rule in live server whenever the dynamic IP of the employee changes.

I tried to put them in office VPN and allowed only SSH access from office IP but the office
connection is slow in compared to our employee's private internet connection, moreover it
adds an extra overhead to our office network.

Is there any way I can solve this problem ?