SSH restricted access based on IP

I would go for the hosts.allow/hosts.deny approach for it is the easiest to remove again later and it works like a charm. As to your question (emphasis by me):

ACCESS CONTROL FILES The access control software consults two files. The search stops at the first match: o Access will be granted when a (daemon,client) pair matches an entry in the /etc/hosts.allow file. o Otherwise, access will be denied when a (daemon,client) pair matches an entry in the /etc/hosts.deny file. o Otherwise, access will be granted. A non-existing access control file is treated as if it were an empty file. Thus, access control can be turned off by providing no access control files.

So your example would work, you may want to change the "ALL" into "PARANOID" in the hosts.deny for added security ;)

-Stefan