How to securely allow RDP and SSH access to DMZ

I am looking to create a new VMware cluster on a new network and need to be able to securely provide RDP and SSH access to both myself and potentially a third party.

The whole setup will be set up in a data centre with a number of esxi hosts, firewalls and and switches (L3)

The expected configuration will be something like;

VMware management on 192.168.1.0/24 on vlan 1 connected to interface 1 on firewalls DMZ on 192.168.2.0/24 on vlan 2 connected to interface 2 on firewalls

All access is via the internet, there is no internal lan to speak of, the only segregation at this point is management away from DMZ.

Access to everything on vlan 1 is through a VPN and there is no need for any ports to be open to the public.

Servers in DMZ only currently expose 443 and 80 and this is provided by reverse proxy, web servers themselves are not directly accessible.

I will need to manage these servers and at some point may need to provide third party access to them.

What is going to be the best way to provide access in both scenarios?

Thanks