If you want a service (such as SSH) to be available and able to be used, then Nmap will be able to find it. Generally speaking, port scans are not a threat; your security should not depend on an attacker not knowing what services are running. Using a non-standard port for SSH is mainly useful for log noise reduction, since there is so much automated brute-forcing done on the default port 22.
Your primary goals from a security standpoint should be: Know/Predict, Prevent, Detect, Respond, and Recover. Here's how port scanning relates to these:
Know/Predict: Know what assets you have and what attackers will go for. Port scan yourself to see your exposure. Understand what port scans can and cannot do; they are not magical hacking fairy dust.
Prevent: Use a firewall to prevent access to ports/services that should not be public. Restrict access to known IP addresses. Move sensitive data and servers behind the network perimeter and control access with a VPN or other access control. Rate limiting is not prevention, only delay.
Detect: Monitor logs for port scan, brute force, and other indications of attack. Understand what is normal background noise and what actually constitutes a threat. Set up alerts for indications of compromise.
Respond: Have a plan for dealing with a security breach. Set up automated defenses like fail2ban to respond to threats. Rate limiting can be a response here, but does it really prevent anything?
Recover: Have a recovery plan. Make regular backups and test restoring from backup.