Rather than disabling RDP which I think is unrealistic, I think a simple way to increase greatly the security is to set up an IP whitelist. Have a list stored on a secure and reliable location (S3 bucket for instance) and a script running every 5 minutes, looking for changes to that list. If it changed run a simple command to update the remote IP restriction to all the administrative services in the windows firewall.

No solution is bullet proof but this allows you to manage the server remotely with very little inconvenience, without requiring to set up a VPN or an internal network, and goes a long way to reduce the exposure to vulnerabilities and brute force attacks.

I would do the same thing with IPMI.