RT-AC88U - Block ports 5-8 from accessing router via ssh

On an RT-AC88U, how could you block devices connected to the Ethernet hardware ports 5-8 from accessing the router via ssh ?

I'm looking for a solution that doesn't involve ...

• Enabling the PHYSDEV module (breaks functions in Asuswrt-Merlin).
  
• Matching on MAC addresses (connected devices and their MAC address may change).
• Not giving the admin password to users whose devices are connected to ports 5-8.