So if I understand your requirements, you have the VPN setup so when users connect, they are behind a firewall that restricts all traffic except for 3389 which is used for MS RDP to their desktops to do their work. You also want to restrict users from printing from their work PC's to any external printers, prevent them from cutting and pasting via the RDP session clipboard and transferring files off their PC's.
I think you need to look at this from a network perspective as well as policy settings.
You can create a policy and prevent LPT port redirection under the GPO computer setting "Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection\Do Not Allow LPT Port Redirection". You can also configure the clipboard in the same location.
As far as transferring files from that PC to somewhere else, you will have to restrict protocols at the network layer to prevent SMB, HTTP, HTTPS, FTP, etc from your internal network to anywhere external. If that is already in place then nothing related to the RDP should change that. AFAIK, cutting and pasting of files via RDP is not supported.
Remember if you allow them to access email from their desktop, they can always email files and such out unless you block it on the email server.