Can I minimize maintenance of duplicated Windows + SQL Auth logins?
I would suggest moving all clients to the domain and removing the SQL logins as the AD route is much more secure. If this is not an option then I would probably remove the AD logins and have RDP users use SQL logins as having two logins per user doesn't make much sense.

If for some reason you decide you have to go the two login route I would write a stored procedure to replicate the settings from AD users to your SQL logins. This could be triggered with a DDL trigger. This way you would only have to update one set of users. 

I would also be careful in using AD groups if you are not the only person responsible for the administration of the domain. It's not clear from the database who has the permissions specified for the group as users be dropped in and out of the AD group without your knowledge.