Hardening TSE Win2008, best practice

Hello

A question about TSE security and acces from a RDP connection.
I have just installed TSE 2008 on a Windows Standard 2008. This one is
member of my AD.
RDP acces (via MSTSC) is open for some pepole of my company. But I have only
one server for TSE acces in my local network.
I have made a port redirection on the firewall. TSE is listening on a high
port.

I can't install an another server to realize a TSE Gateway with HTTPS. It is
too expansive for us.

So can I consider this configuration as sufficient to open acces from
Internet. :

My configuration is :
- TSE is listening on a hight port. for example 4625.
- The user authentication is based on AD with RDP encryption.

Or do I have to install the TSE gateway on the same server than the TSE
Server.

I'm looking for informations abour usual practices in small or medium
company.

Thanks for your help.
Fabrice