Linux/RDP
R/O media such as CD ROM or flash with CD-ROM partition
VPN
SELinux
RDP and possibly web browser