In nearly all cases you're going to end up with User+Group [and|or] certificate authentication instead of requesting-machine control. To clarify what cmbrnt mentioned re: LogMeIn, that is still a user-based authentication arrangement, and you're not specifying which client computers can make connection attempts.
You install the LogMeIn software at the host you want to control, and then you log in to the LogMeIn website (user authentication) to make a connection attempt to that host from wherever you want. After which, you'll authenticate again against that machine (or domain).
Therefore LogMeIn is more secure than simply punching a hole for RDP, as you have no exposed services and you're effectively authenticating twice, where both connections (client <-> LogMeIn <-> host) are over secured connections. There's even a third "host password" option you can use if you like, IIRC.
I believe LogMeIn ALSO has filtering for where the connection attempts come from, but they'd be by IP address, which as you stated, is not workable.