By default, the root user is able to SSH to each appliance in the TeamWorks system. When logged in as root, you can disable this access on each appliance so that only the vaadmin user can SSH to the system.
See Changing Passwords and SSH Access for vaadmin and root
in the TeamWorks 18.2.1: Administrative UI Reference.