Why not just deny all root logins entirely over SSH, rather than using Fail2Ban or other stuff? By doing that, and denying the use of the root login, you remove the issue of having to block everyone, because even if they guess the root password, it'll deny them login. Regardless of how many times they try.
/etc/ssh/sshd_config, find the line containing
PermitRootLogin. Edit that with whatever text editor, but make sure you use
gksudo (gksudo only if you're using a GUI text editor). Make that line I mentioned say
PermitRootLogin no, then save, and do
sudo service ssh restart.
(This answer was written for the incorrectly-stated initial question. This answer will not be modified to match the revised question, because that's beyond my ability to answer. I may delete THIS answer in future)