systemctl mask sshd

Symlinks the sshd unit to /dev/null, so it cannot be started by any means, including dependencies or manual start attempts. This is the drastic way to shut down SSH after a compromise or on a hardened bastion. Re-enable with systemctl unmask sshd.