If you keep SSTP enabled and reachable, you should at least put it behind some port-knocking mechanism. It doesn't have to really use "ports". Here is one method that does not require complex tools or non-standard ports Rules against scanners - #36 by CGGXANNX.