Not a Docker expert by any stretch, but I believe Portainer can only connect to the socket locally. If you were to bind that socket over a ssh tunnel, you’d be limiting your Portainer to managing a single machine. You’d also be dealing with broken pipe errors every time the connection went idle.
Given those limitations, it’s much easier (and, I’d argue, more secure) to just spin up a Portainer container on that machine.
If you absolutely must use SSH, see this thread for the only working solution AFAIK:
“To announce that there must be no criticism of the President, or that we are to stand by the President, right or wrong, is not only unpatriotic and servile, but is morally treasonable to the American public.”