Protecting an SFTP server at the firewall level

I am trying to secure an sftp server that needs to be open to the internet and cannot be accessed through a VPN. I have researched methods of securing this device, I am looking for a second opinion on how to go about securing an sftp server that is open to the internet.