from="1.2.3.4",command="/root/bin/rsnapshot_wrapper.sh" ssh-rsa AAAA...
/root/bin/rsnapshot_wrapper.sh: #!/bin/sh
LOG="$HOME/rsnapshot_wrapper.log"
if echo "$SSH_ORIGINAL_COMMAND" | grep -E >/dev/null '^rsync --server --sender -v*logDtprRxe\.iLsfx --numeric-ids \. [/a-zA-Z0-9]+$' ; then
$SSH_ORIGINAL_COMMAND
else
echo "Invalid command: $SSH_ORIGINAL_COMMAND" >>"$LOG"
fi
exit 0
[1] I exaggerate a bit, sometimes I use uBlock Origin's "block element".