One of the features introduced in TFS 2015 Update 3 is the backport from VSTS of SSH access for Git repositories.
There is a very nice document on how to use it, so I am not going to look at that, but what is interesting is what happens on the server at upgrade time.
You can decide whether to enable the service or not:
and this will automatically create its firewall rule:
Moreover, you can manage the service from the Administration Console:
A small touch, but much appreciated from an administrative point of view 