Tunnels to allow a few people have ssh access to lots of devices

I think Tunnels will do this, but maybe I’m misreading - hence the question.

I want to allow a few people to have ssh access to a fairly large fleet of IoT devices. They’re able to run cloudflared (on “pi-like” devices). I could set up a server in the cloud as a sort of bastion server and have each of the devices create their own ssh reverse tunnel, but it starts to be a hassle with all the certs or user ids. Can Tunnels simplify that?