you don't need ssh from oem to OVM to install the agent.
If you use a firewall between OEM and OVM, you have to check that all relevant ports are open.
You don't even have to store the credential for the installing of the agents.
Please the documentation here:
You need the Exadata Plugin and the Virtualized Platform Plugin.