Given: my local network is 10.1.1.0/24, my username is jabenninghoff, my ssh host is ssh.example.com, my host's address is 10.1.1.17, my ssh port is 22, and I'm connecting from either 10.1.1.33 (locally) or 172.16.1.20 (remotely)
When: connecting from the local network
Then: allow default ssh authentication methods
When: connecting from other networks
Then: require key-based authentication
Configure using a Match rule:
Match Address *,!10.1.1.*