UFW, by default, blocks all incoming requests. This means that SSH (port 22) is blocked already. Then, if you need to, whitelist (ALLOW) ports that you want to expose to the network. For example, I have ports 1714-1764 whitelisted for KDE Connect and everything else is blocked.
Holy shit