

No, AllowedIPs should be set to your internal Wireguards IP range to only allow access to your Wireguard peers. You could also add more like your Servers LAN for example (which will need packet forwarding, as I mentioned before)
Here’s an example of one of my client configs:
[Interface]
Address = 10.8.0.2/32
PrivateKey =
[Peer]
PublicKey =
PresharedKey =
Endpoint = 192.168.0.3:51820
AllowedIPs = 10.8.0.0/16
Just be careful to not mess up your subnet masks. For example my [Interface] Address ends with /32 because that only leaves 10.8.0.2 In the [Peer] Section i set it to /16 which will allow the client to connect to 10.8.x.x iirc
Best is to just try it yourself and see if it works, I’m by no means good at networking stuff
Like others said, disable password auth and setup auth keys instead.
Bonus points for moving the ssh port, using fail2ban and also setting up a tarpit with something like endlessh.
If you wanna go extreme use Wireguard to connect to your server and only allow ssh over wireguard in your firewall.