This is an old thread, but I just ran across this today search for the same thing as the requester. Unfortunately, the responses are terrible, as they are in a couple of other threads I've found. Using the Windows FW, which is not a "real" firewall, is much better if we were able to easily use the Security Connection Rules for something like limiting RDP access to specific hosts, because it enables the FW rules to use computer accounts rather than IP addresses. IP addresses are more difficult to manage; computer names are much easier to manage than IP addresses.
It's sad that seemingly no one on the Internet has posted some simple steps to facilitate using the "remote computers" tab of the Windows FW rules to limit access for something like RDP. I have had a call open to Microsoft Premier Support for over a day and still don't have a working solution.
As for the rules, overall, they are not prioritized and seem to be in a least-privilege wins model. If you created an "any-to-any" rule for ALL ports (and don't set the services or programs so that ALL services and programs are included) EXCEPT for RDP (TCP/3389), you would allow all traffic to and from the server, and then you could add a rule SPECIFICALLY for RDP (TCP/3389) where you could limit the scope of RDP access.
By the way, using the above suggestion, when enabling the WIndows FW, you could leave all of the default rules in place, simply disable the RDP-specific rules, add the "any-any except RDP" rule, and add the new RDP access rule. That way, if you later decide to further lock down access, you already have working rules in place.
Also, using a GPO is a lot easier to manage while testing because if you mess something up, you can simply revert on the GPO. You can filter the GPO to a specific computer, too.