You need to SSH into a Compute Engine instance that does not have an external public IP address. Your local workstation is not connected to the VPC via VPN or Interconnect.

What is the most secure and Google-recommended way to connect to this instance?

Identity-Aware Proxy (IAP) TCP forwarding enables you to connect to VM instances that do not have external IP addresses. It works by wrapping the SSH connection inside an HTTPS request to Google's infrastructure, which verifies your IAM permissions before forwarding the traffic to the private VM. This eliminates the need for bastion hosts or public IPs.