Maybe it is my misunderstanding here, but I would love some clarification
a GPO set with 'Allow & Deny log' => control the console access
a GPO set with 'Allow & Deny log on Through remote desktop services log' =>
control the ssh access
if this is expected, I believe the documentation need some work