Buoyancy is just the weight of water your air volume pushes aside. You submerge by flooding ballast tanks to cancel that lift, and surface by blowing them back out with compressed air. The one rule that governs the whole design: any failure must default to floating.
The sphere floats with reserve buoyancy until you flood the tanks. Fill the ballast and watch the freeboard shrink until it goes neutral and rides down its guide wires.
Lose power, lose air, spring a leak - the unit must rise, not sink. That means reserve buoyancy at all times, watertight compartments so one breach floods only one cell, and ballast that sheds automatically when systems drop. Design the failure, then build backwards from it.
A tall two-floor sphere is naturally top-heavy. Two fixes: a spar-buoy layout with heavy ballast low and a deep draft, or rigidly interlinking many units into a raft that rides flat. Keep the centre of gravity below the centre of buoyancy and it self-rights.
A single pressure hatch on the top deck, in air when surfaced. It seats inward against its frame, so the deeper you go the harder the water clamps it shut. Dogged down it is a structural plug, not a swinging door. No submerged access means no airlock and no decompression - occupants stay at one atmosphere inside, like a submarine.
Wave energy is a surface phenomenon and decays fast with depth. Submerging to ~10 m lets a unit sit calm beneath a hurricane that would batter it on the surface - a genuine advantage in Bermuda. Guide wires and tension moorings hold station while it is down.