It looks like "you can just create a symlink to mask
ssh.service, before installing the package". E.g.
ln -s /dev/null /etc/systemd/system/ssh.service.
I suppose this requires that you know the name of all services created by the package.
I am aware of one minor disadvantage for this approach. If you have a masked service which is also marked as "enabled", then
systemd will log a warning during startup.
Note that a
systemd "mask" will prevent the service from being started by any method, including manually running
systemctl start ssh. So depending on what you want to do, you might want to remove the mask after you've installed the package.
If the package is
ssh, it has a specific hack you can use instead! Bad news: this implies that a specific hack is needed in the package because all the other approaches have disadvantages. But you can have a look at the approaches I considered if you like :-). Configuring my sshd securely (with automation)