We currently use DUO for our RDP connections, directly and without VPN (Port open on firewall). Have never had an issue.
We purposefully don’t want VPN because we don’t need network level access and we don’t want people’s potentially infected remote...