Firewalld configuration / pinhole?

Question

I have a host with two interfaces:
ens32 /zone=internal 10.10.0.47
ens36 /zone=public 192.168.0.47

I have a workstation at 192.168.0.88

I'm trying to configure firewalld to allow ssh only from a set 'AmazingStaff'

set AmazingStaff {
        type ipv4_addr
        flags interval
        elements = { 192.168.0.88 }
}

It is my understanding that interfaces can only have one active zone, thus ens36 would be public.

Is it possible to allow the 192.168.0.88 through for a single service like ssh? This will be a web server (yes there is an actual hardware firewall also) so am looking to just allow ssh to this named set (in addition to the other public services) like

Is it possible?

I've tried also:

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  source ipset="AmazingStaff"
  port protocol="tcp" port="22" accept'

which yields

public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client
  ports:
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
        rule family="ipv4" source ipset="AmazingStaff" port port="22" protocol="tcp" accept

but still am unable to ssh from 192.168.0.88 to 192.168.0.47

I know this isn't probably best practice, and probably the question will be.. why do you want to do this when you have the internal interface. We have another host with a single interface, so I'm hoping to implement the strategy there if I can get it working in this scenario. And yes, dhcp is only active on the public interface as it in a test environment.