I am looking at implementing some sort of multi-factor authentication for a Remote Desktop Gateway at a small office (less than 20 users).
Where would be a good place to start for a quality, economically-feasible solution for a small office?
We're running a TSG with client certificates configured to allow users to connect to their desktops. As long as you allow port 443 and properly configure the resource access policy, it works. There's a tutorial on technet on how to achieve this.
However, we're only using it for a small number of people, and we've not run into any of the licensing issues that I think sdnelson mentions. I would check this out before progressing any further.
I believe TSG supports radius, so you can use any two-factor authentication server. Ours starts at $240, so the expense is not that great. You might have to run something else in front of RDP that supports radius and then run the MS radius plugin NPS on AD. Here's a (reg-free) white paper on how to add two-factor auth to your network http://www.wikidsystems.com/learn-more/two-factor-authentication-white-papers. RDP isn't mentioned, but it describes how to implement a number of services so you can get a good overview (or any service or 2FA server).
SecureMFA Microsoft RD Gateway OTP Provider https://www.securemfa.com/downloads/mfa-rds-otp allows implementation of OTP functionality in RD Gateway. It allows to use MSTSC client (requires MS RDP client version 8.1 and above) for access with OTP and has its own web portal to allow access using browser interface.