Thanks guys, that makes a little more sense. I think Apache Guacamole will be the way to go for this one scenario (and probably lock that down to trusted IPs), and I'll stick with VPNs for everything else.

But I'm finding the discussion interesting, and just looking at it from a purely academic standpoint:

• I knew that a non-standard port did little to prevent people finding an open RDP port.
• I knew lockout policies were only a defense against brute force.
• I knew that neither of the above, or NLA, were a protection against possible newly discovered (or unpatched) exploits in RDP itself.

But my thinking was these weren't overly important if it was locked down to a only a few trusted IPs. I surmised that the port couldn't be easily found if not scanning from a trusted IP, and that any potential exploit could only be taken advantage of by an attacker coming from a trusted IP.

SpartanVXL:
The whitelist of IP’s is just changes the level of security. It can significantly lower the chance of an issue happening as you drop a wide scope of entry, but there is still an avenue of attack which is the ‘trusted’ IP’s.
If you consider how easy it is to avoid geoblock, it’s the same manner if somebody figures out you have a whitelist.

Isn't circumventing a geoblock a lot easier than appearing to come from one of only a few specific IPs. Wouldn't an attacker first need to determine the trusted IP(s), and then successfully spoof said IP in such a way as to take advantage of an unpatched exploit (if one exists). In short, wouldn't it need to be a highly motivated and targeted attack?