If you white list the IPs that you trust, that implies every other IP except those are blocked. That will effectively prevent other IPs from DOS attacks. The assumption of course is that the firewall configuration is not erroneous and/or the firewall itself is considered "secure" by any reasonable standards.
Where a tool like RDP Defender comes in to add value, is when you can't know the specific IPs that should be using your service and thus cannot white list them, and/or you don't want to assume those IPs are trustworthy.
RDP Defender, and tools like it, allow you to open up your services to IP's and then it looks for behavior patterns from those IPs and blacklists based on behavior criteria.
It is worth pointing out that, according to RDP Defender's site, this tool works by monitoring for failed login attempts and then leverages windows firewall to put rule(s) in place to block traffic from those IPs. This is important to think about for several reasons:
1) DOS/DDOS attacks don't necessarily leverage logon attempts, and thus will go undetected and unblocked.
2) The defense of blocking the IPs where suspicious traffic is generated, in itself, can be used as the attack method for DOS. If an attacker can embed itself into something a lot of people use, when that attack launches it will be coming from a lot of IP addresses. If your defense is to block each of those source IPs, some of those IPs might be valid customers of your service which are getting shut off. If your defense is to block entire sub nets, that will certainly have the potential to shut off a lot of IPs not trying to do harm. Lastly, if the attacker spoofs IP address, then they can target to make you shut down IPs as they wish.
Disclaimer - I never recommend that someone put a server onto the public Internet (especially Windows) without the expertise of someone who knows all the intricacies involved. Your best case scenario is a very hardened system that is as protected as is possible considering the nature of the services it has to provide to the public Internet, but still vulnerable in ways which you know and your business have assessed and decided risk accept. Your worst case scenario is thinking your server is well hardened and protected, but isn't and you find that out in a way that costs the business huge amounts of lost revenue, fines, legal liabilities, and/or impact to reputation. Moreover, even if the security is very effective at time of deploy, it is not untypical for that security to fade as time goes by -- so there is an ongoing operational aspect to think about.
My answer is not intended to do anything more than help you think about this.