NOS Hardening Guide?

Yes there is a firewall - the CentOS flavour of IPtables is running on your CVM's. As far as an official hardening guide goes I do not believe one exists, but if you fish through the discussion boards here you will find a few nuggets of wisdom. The most common recommendation is probably to isolate your CVM's from standard VM's on their own management network.

Also - you can install SSL Certificates through Prism, but if your question is specific to using SSL certs for SSH auth that may not be very helpful. I know that 2FA and key-based access is a component of Cluster Shield, but I'm uncertain if that reaches all the way to SSH.