I'm a sysadmin in a small company, and have what I would describe as a moderate understanding of networking. I'm trying to create a situation in which a number of internal hosts are accessible over RDP from the Internet, but cannot communicate with the office network, nor each other. All will share a single public IP, so users connecting from the Internet will append a port number in the Remote Desktop Connection client in order to reach a particular one of these hosts. The hosts will be virtual machines on ESXi.
Having done some initial Googling, I spent a day playing with Vyatta, and am really impressed with it (in particular I find its documentation excellent). However, I realise that my problem is not understanding specific concepts or following instructions; it's that I don't properly know what network technologies and topology I should be using. I imagine there are multiple possibilities. I've heard VLANs mentioned a lot.
I should add that we have a mid-range small business firewall and that, if necessary, we can designate one of its ports to be its own interface that passes traffic exclusively between the WAN and a spare physical NIC on the ESXi host.
So my question is, what technologies and topology would you consider most suited to creating the situation I have described? To recap, I want multiple internal VMs that are isolated both from each other and from the rest of our office network, but can be connected to from the Internet via RDP (on a single public IP but unique port numbers).
Many thanks in advance.