How can I expose port 3389 using a secure approach
You can add, if it's not already the case, a frontal, rev proxy, to prevent direct access to the TS. This could also add an authentication layer...
I am not a lot in Microsoft stuff so this is really a basic advice.
If TS allow the use of pubkey instead of passwd this would be a good addition too.