Yes, using a ProxyCommand in the ssh configuration allows using the SSH client to connect over SSM. In that case - you do need an SSH keypair in addition to the IAM authentication. No need to expose the management interface to the internet.