Ssh allows you to start a new (separate) text login, but that's not the only thing you can do with it. It also allows you to do things like tunnel internet, tunnel a port, and start a graphical program in that new text login and have that program show up on the local computer but run on the remote one. All of this is encrypted, so it it safe to send confidential things like passwords over it.
Also, do realize that on a Linux machine, it is possible for a user to be logged in multiple times. (This seemed so cool when I first came from Windows).
VNC sends passwords unsafely, which means that it is possible that someone could listen in on your connection and then use the password they hear to login themselves!
So, the general idea is to use ssh to securely connect and start a new text login that you basically don't use. Then you tell ssh to also tunnel the port for VNC, which means that the VNC is wrapped in the ssh encryption so no one will hear your password. When you connect to the remote VNC server, it show the graphical login, not the text one.
How to do this:
you run something like
ssh <monitoredusername>@<monitoredcomputeripaddress> -L <randomportabove1024>:localhost:<monitoredcomputer'svncserverport>
This will magically make the monitored computer's VNC server "appear" on your local computer at . Then you can do