I have a vendor who needs to connect remotely to one of our servers. What I thought I would do is setup a NAT rule in our firewall. I have a public IP address that I will have translated to the local server address so that then the vendor just needs to RDP to the public IP address. Is this a secure way to have the vendor connect? I can restrict the service to port 3389 and set the source IP address to only accept the vendor's public IP address.
Source address restriction is a good idea if your vendor use static IP addresses.
Btw, as Mike Naylor mentioned, you should translate to non-standard port instead of 3389 to prevent insider threats from your vendor.
The last point is you can limit connection rate to prevent brute-force or flood attacks even when attacker know the service's port.