> Can I disable port 22 and remove the SSH client altogether and still use AWS CloudShell on an instance?

Yes, provided you whitelist the IP range for Amazon's Instance Connect service. (They don't call it Cloud Shell.) From [0]:

> We recommend that your instance allows inbound SSH traffic from the recommended IP block published for the service.

You have to trawl the giant JSON document that it links to, to find the relevant IP range to permit, where the region matches yours and where you see "service": "EC2_INSTANCE_CONNECT". Then, whitelist the specified IP range (obviously for incoming traffic on TCP port 22).

[0] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-inst...