First of all, download and read the guide I wrote, "Terminal Services A to Z" from
http://www.wtslabs.com. Free.
All you need to know about TS from its history to how to lock it down is there.
Regarding how your users would connect, on 2008 R2 you have a couple options.
They can either use the Remote Deskto Client to go directly to the TS IP address where they would get a 'full desktop' or you can install the RDS Web Access role and use RDS RemoteApps to present them with a web interface that once they logon, they see the applications they have access to (like Word, Excel) and when launched, all they see is the application, as if they were running locally.
As I assume you will keep the VPN, both options will be very simple to them.
Connect to the VPN, launch RDP client or go to the RDS Web Access page and launch apps from there.
Cláudio Rodrigues
Microsoft MVP - Remote Desktop Services
Citrix CTP