Seucring Terminal server (MS RDP) with 2FA

Morning, 
Just checking in ref the zyxel best practices for securing RDS.
Is its still SSL VPN then RDP?

Customer looking for some form on 2FA with RDS ( running ZyWALL 310 - 4.31(AAAB.0))
is the "ZyWALL OTPv2/OTP-MOBI" the only offering, any support for yubikey?

Links to any guides / how to appreciated

Thanks