RDP is as easy protocol to scan for, and thus attempt a brute force login, especially if you still use the default user accounts on Windows PCs. Never expose RDP externally for that reason.
That said, we still enable it internally for providing remote support to users. Make sure you lock down the users that can use it internally via the local Remote Desktop Users group on the workstations. You can do this through: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow Log on through Remote Desktop Services
If you do want to disable it, you'd be better off disabling it via group policy (Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Allow users to connect remotely using Remote Desktop Services) and/or blocking port 3389 on the client firewall, rather than trying to stop the execution of mstsc.exe.