Yes that's the right way to block root login. An added filter you can use the 'match' config expression to filter logins even further.
If you're on the open network, your connection will be heavily hit with login attempts. That is normal. But using another service like Fail2Ban will stop repeated hits to your host.
~~Ssh listens on port 22, as soon as a connection is made the host moves the connection to another port to free up 22 for other new connections.~~ Btw: I wasn't thinking clearly here. Out going connections won't be using port 22, but the listening incoming port is always 22.
Match blocks allow you to restrict who/what is allowed or not allowed to connect to the server. There is a large number of options to utilize. Put this near the bottom of sshd_config. There should be an example there.
Here are some more examples: https://stackoverflow.com/questions/10829712/sshd-with-multiple-match-sections-override-settings