Point taken via GUI for AD security groups, but in the case where you also have a common local admin account on every Mac--and you hide user via UID < 500, the GUI does not see such accounts, hence you cannot add the accounts to ssh restriction.
That's the whole point of hiding via lower UID: hide accounts from GUI. You might be able to add local admin accounts to ssh restriction PRIOR to running the command below...
sudo defaults write /Library/Preferences/com.apple.loginwindow Hide500Users -bool YES
...then run the command above after excluding/confirming via GUI?
Pretty sure the
dscl method allows you to exclude the account--regardless of hiding 500 users, but you can't confirm via GUI; only via CLI.
Again, working as designed, but might not be obvious at-a-glance.