Windows non-AD connected rdp login options

Hey folks, looking for suggestions for managing access to windows instances in a non domain environment. Specifically around granting and maintaining rdp access other than username/password. is there any way more akin to ssh public key style auth options for rdp?

I need to stand up a number of isolated/disconnected windows 2016 based systems and need to grant access to 10-20 people. I'd really prefer not to have to manually manage passwords for these folks if possible. Are there certificate based options available?