We have some clients who continue to drag their feet on retiring RDP usage for end users... We have implemented the following to try to mitigate attacks :
1. Geo-Location Blocking. (Block all but your own country) this reduces the brute force attacks quite significantly, though this is not a solution, but a way to slow down things.
2. Restricted by Static Public IP. (this has been handy for our admin guys, so only they can RDP to servers
3. Introduce a Secure Mobile Access device, and enable Multi Factor Authentication. This is the best solution so far if you really need RDP services. Sonicwall make SMA210 which is reasonable, can be married to Microsoft authenticator app on a mobile phone for the MFA. You can implement one in 4 hours plus roll out time for your users.