If you want to RDP to it, you could setup a cloudflare tunnel and only allow access to it via WARP.