As with anything you allow out of your firewall, you are opening a possible covert channel. Just because port 22 is usually SSH, doesn't mean that it has to be. I don't believe this would be a huge concern, though. Most automated malware is going to use port 80 or 53 for C2 which is probably open out as well.

If you are opening port 22 out for only specific IPs, as long as there is a valid business need for that hole, I'd say your taking the necessary precautions. If only one IP needed it and you just opened the firewall for that port completely out of convenience, then I'd say you might want to reconsider.

As others have pointed out keeping outbound access to well known IP addresses is the way to go. Here is a nice link showing use of openssh for tunneling.

http://packetheader.blogspot.com/2009/01/installing-openssh-on-windows-via.html

One thing to keep in mind is this applies to all ports and not just SSH since you could change the SSH port from the default 22 to whichever outbound port is open.

Great points/advice all.  This helped a ton!  Thanks!