In /etc/ssh/sshd_config do:

PermitRootLogin without-password

That way root must use a public key to login, but other people can still use passwords.

(But watch out for sudo.)