LDAP authorization on windows server?

Question

LDAP

We have:
Dedik windows server 2012 on which the usual office programs.
Task:
employees from the office need remote access to this server (remote desktop), for each employee there must be a hotel account (20 accounts).
The user must log in not directly to the server, but through an "intermediary" and get to the remote slave. table of your account on win server.
Question:
How would it be correct to organize authorization and through what?

Answer 1

Users will be connected on rdp? It's not safe.
Further, if there should be a separate account, then users should be created in windows, while they are given a login and password, respectively, they are also used when connecting via RDP, why an "intermediary"?