Can I use DO private networks work to limit ssh access

I’ll be creating six Droplets (Debian) with both UFW and DO firewalls all to run a copy of a web service. I will also create one droplet to manage these servers. Can I set the firewalls for the servers to accept incoming requests on HTTP/HTTPs only on their public IPs and accept ssh only on their private IP address and only from my managing server (via a domain name of course)

If so then I’ll set the managing server’s firewall to only accept incoming SSH from a limited number of IPs that I own elsewhere. I’ll ssh onto the manager and then ssh from there to the web servers. This way the only access to the web servers will be via HTTP/HTTPs.

If the above is possible does anyone know where I can find an example UFW configuration showing how to work with the DO private networks?