RDS 2016 Deployment - Certificate & Port queries

We have deployed RDS 2016 and I have a few questions with regards to

1. Certificates

We have 7 users accessing the published apps using RDWeb using the client VPN and we have setup only internal access.

FQDN of RDS Server: RDSSVR01.ka.domain.com (which is our internal domain)

Kindly advise if we go with SSL or Wildcard certificate and what names must be included in the certificate

Server01 - AD & RDS Licensing
Server02 - RDS Session Host
RDSSVR01 - RDS Gateway + Broker + Web Service

2. How secure is port 3389 and is it advisable to open this port for public/internet access to RDWeb. Our hosting partner claim "Please note that opening port 3389 poses a security risk and RDP access via SSL VPN." Any advise

3. In case we open port 3389 for internet access to RDWeb

Internally the URL: RDSSVR01.ka.domain.com/rdweb

Externally the URL: rdsess.domain.ka/rdweb

Please advise if the above works, what entries must i have on my SSL or WC certificates