RDP stands for "Remote Desktop Protocol", so what it provides to people who connect is a full fledged session on the server. By default, this gives these people the same kind of power that they could have by sitting in front of the machine (except that they won't be able to attack the machine "physically").
If you want to prevent users from, e.g., uploading arbitrary executable files to the RDP server and running them from the server, then you have to restrict the Windows session down by deactivating right-click on most items, removing most or all of the "Start menu" entries, preventing copy&paste of files through RDP, and generally speaking nerf it down. All of this can be down through Group Policy Objects pushed from the Active Directory server. However, there are a lot of details to think about, and since this is a blacklist-like activity, it is difficult to know if you thought of everything (for instance, if you want to allow users to connect to a second server through Internet Explorer but do not wish them to access the configuration menus of IE, remember that the "Alt" key can make these menus reappear, if you just "hide" them). As a general rule, I would advise against using an intermediate RDP server as the foundation for your security; you'd better treat the RDP machine as "potentially hostile".
The security situation is similar with VNC, since it exports a desktop. The comparison between RDP and VNC will be mostly over performance and integration (if using a Windows server, RDP will be easier to setup for multiple concurrent clients, and will offer better performance over slow networks; for Linux systems, consider FreeNX).
