A better alternative would be ProxyJump. See e.g. https://serverfault.com/questions/958222/bastion-server-use-...

Edit: To add some details - using ProxyJump you don’t have to expose anything to the jump host and instead just proxy through it.