In my workplace people are connecting with their PCs (with Windows on them) through basic RDP when they work from home. The only precaution taken is changing default 3389 port to a diffrent one and using strong password. This seems like a bad idea. There is no option to configure simple VPN to gain access to files because employees need to remotely use software that utilizes physical HASP keys- avaliable only on their computers. What is the correct approach in this situation?
Yes, RDP per se isn't secure enough to use over the Internet.
There is no option to configure simple VPN - why not? You should definitely use VPN to secure RDP access: set up a central VPN gateway, VPN clients and remove the port forwarding mappings from your NAT router.
Product recommendations are off-topic here however, but you could try on Software Recommendations.
Changing the RDP port is security through obscurity, and not really viable when there are only 65535 TCP ports to scan.
Using a VPN and then hopping through that to connect over RDP is pretty standard. As mentioned, you can often set this up on a enterprise, or even SMB, router.
However, another solution is to use a Remote Desktop Gateway server. It uses a special protocol which essentially acts as an HTTPS tunnel/proxy (with a secured UDP performance protocol also). It is supported by nearly all RDP clients I know of. Although primarily designed with a VDI solution in mind, it can also be used very easily for normal workstations.
There are a number of different providers for this, you may want to go to Software Recommendations for different options.
The protocol allows complex policies as to when to allow logons, for how long, which PCs, what device redirection, etc. Not all provider support all of these.
The benefit of this over a VPN is that you have far more control over what is going once a user has connected to your network, and they never directly route their device onto your network, so you are far less vulnerable to anything they have on their private devices.