On core devices you can run snap set system service.ssh.disable=true to disable sshd (and similarly for rsyslog); it’s considered part of the system’s configuration (and you can default it to disabled via the gadget iirc). You can’t run snap from inside a snap, so you can’t do that, but the snapd-control interface lets you talk to the /run/snapd.socket socket, so you can use the API.