I agree. What you are proposing is not a secure way to go.
If I'm reading this right, you want to setup something (like a NetCat shell), listening on some oddball port. You then want any inbound connections to this port to be forwarded to the Windows box running Terminal Services on port 3389.
So a client would connect with their TS/Remote Desktop client to this oddball port, and with NO AUTHENTICATION at this point, they get internally redirected to TCP port 3389. That's you idea?
Yeah, that's not a good idea.
A port scan with a tool like NMAP can determine that there's port redirecting going on. That's a red flag for something to be looked at. And there is at least 1 tool that I know of that is specifically designed to do a dictionary attack against TS connections.
If your clients need to do something secure on the cheap, here's my suggestion.
Take one of their workstations (even an older one), install Win2K Server or Win2K3 Server on it, and install RRAS. In RRAS, setup the machine to be a VPN Server.
Dual-home this server (put in 2 network cards). One NIC is the inbound from the Internet, and this NIC is also the one running the VPN Server ONLY. Nothing else on this NIC. The other NIC goes to the internal network that can connect to the box you need to TS into. Configure the VPN Server for authentication and all that, and to route TCP port 3389 to the machine you want to TS into.
This way, they have inbound VPN that is secure. You've got to authenticate to the VPN server to get into an internal client on TS. You get security, encryption, all that fun stuff.
And all you need is a machine.
There are, of course, other steps to take if possible (multiple internal network segments, firewall screening, etc), but that just depends on if there's any money to spend doing this.
Here's an article on setting up VPN Server in Win2K3:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/00c498a8-95e7-4780-942e-c4594b01f615.mspx
