Is there a way to force ssh tunneling to be required for Screen Sharing
I would advise you to create a permanent ssh tunnel so you can local forward the connection port from the Windows host to the connection port on the Mac host using Bitvise Tunnelier: https://www.bitvise.com/tunnelier, while not personally having used it, this question explains a similar problem: https://superuser.com/questions/235395/automatic-ssh-tunneling-from-windows