Linux SSH – What Happens When Password Expires with Key Authentication?

Since you want to use a password that is something other than the one for your normal account, try security/pam_pwdfile from the ports tree.
Basically, it allows you to use an alternate file (format: username:crypted_password) to authenticate against.
To use it, put the following line in /etc/pam.d/sshd right before the line for pam_opie:

auth    required    /usr/local/lib/pam_pwdfile.so    pwdfile    /path/to/pwd/file

Short answer: You can't.

Long answer:

Full disk encryption won't save you when it's running. The data is available, decrypted, on your running machine.

The VM provider can clone your machine at any time, especially if it's not encrypted. From the cloned machine, they can mount the system from another machine (like this) and change the root password or examine any information stored on it.

Check out the physical security section at the Arch Wiki. All of their tips focus on the case where you physically own the machine, and you can have some semblance of control over who boots it and what they do when they boot the machine.

If you don't have that, then you have to trust your hosting provider. This includes trust that they won't do something evil to you, and the trust that they will protect you against security threats where other people will do something evil to your VM without their permission.