What are relevant Windows Policies to secure access from the Internet to Remote Desktop?
I'm thinking about things like failed login attempts and similar.
I'm not aware of anything to restrict based on where the RDP client is connecting from (either based on range or zone), but you could simply not forward port 3389 into any of your machines.
As far as failed login attempts, I believe that the only way to handle that is via your regular account security policies. Set a number of failed accounts, lockout period, and reset time (if any).