An alternative to notify is subscribe:
file { "/etc/sshd_config":
source => "....",
}
service { sshd:
ensure => running,
subscribe => File["/etc/sshd_config"],
}
The difference being that the relationship is described from the other end. For example, you might make apache subscribe to /etc/apache/httpd.conf, but you'd make a vhost file notify apache, as your apache class won't know about every vhost you have.
A similar dual-ended situation applies to require and before. It's just a matter of which makes more sense in the particular situation.
As Chad mentioned, if you find puppet constantly trying to start your service, then you need to add a pattern parameter, which is a regex to apply against the list of processes. By default puppet will do a stop and start to restart a service. If you add "hasrestart => true", then it will use the command specified in the "restart" parameter to restart the service.