How to restrict "Remote Login" (ssh) access to only certain IP ranges?
From man sshd:

/etc/hosts.allow
/etc/hosts.deny
Access controls that should be enforced by tcp-wrappers are defined here.  
Further details are described in hosts_access(5).


https://debian-administration.org/article/87/Keeping_SSH_access_secure offers these examples:

# /etc/hosts.allow
sshd: 1.2.3.0/255.255.255.0
sshd: 192.168.0.0/255.255.255.0

# /etc/hosts.deny
sshd: ALL


The TCP wrapper program in Mac OS X is: tcpd