Terminal Server in DMZ for limited access to Internet resources - user authorization

Hi

For security reasons we need to deploy following scenario (sorry for Paint):

So, users from Intranet should login to terminal server in DMZ for limited access to Internet. The main question is - how should they authenticate on terminal server? RODC, ADAM or maybe TS must communicate with ADDS server directly? Best practices?