I have a bunch of remote MySQL servers, that allow connection only from localhost. To connect to them I do the following:
ssh host
mysql -uuser -psecret -hhost.m
Take a look to 'sql-mysql-program' to "and 'sql-mysql-options'. You can bind the first to "ssh" and the second to "host mysql". If emacs does not insert 'sql-mysql-login-params' between them, you will be in the clear. If that is not the case, you need to create a script that just does "ssh host mysql" and then point 'sql-mysql-program' to that script.
If you need to use both tunneled and not tunneled mysql connections at the same time, you might consider adding a new element to 'sql-product-alist' (something like "tunneled-mysql").