Remote access servers are placed at the network perimeter rather than at a sub-network perimeter unless there is a compelling reason otherwise; where there is a perimeter firewall with a demilitarised zone, that zone is normally the right place, and endpoint remote access servers go in the demilitarised zone whenever possible. Placement considers device performance, the fact that encrypted traffic cannot be inspected by network security devices, the traffic the solution leaves unprotected, and the need to limit what the server can talk to internally so that a compromise does less damage. Relying on internal workstations to provide remote desktop access is generally not recommended.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.