You configure a user account group to only allow the use of classic function block editor and views and turn off the possibility to use Builder for Function Block.
If you do not want to connect to your automation server using the SSH port 22, you can add another port.
You can disable port 22 and the USB ports on the automation server.
You disable port 22 on your automation server to avoid cyber-attack on this port.
You engineer your system using the engineering tools.
To increase security, you disable the USB port on your AS-B server and AS-P server.