How can I expose port 3389 using a secure approach Within our legacy infrastructure we need to keep port 3389 exposed so that we can remote desktop into this server (note that we can't go back and utilize IaC to prevent this). 

We currently restrict the IP range that can access this port. Is this enough for security? This article mentions never globally exposing this port: https://www.grc.com/port_3389.htm
You can add, if it's not already the case, a frontal, rev proxy, to prevent direct access to the TS. This could also add an authentication layer...
I am not a lot in Microsoft stuff so this is really a basic advice.
If TS allow the use of pubkey instead of passwd this would be a good addition too.