Hi,
About security Best Practices: Security Best Practices and Resources
Tools to use? Whatever you want, if you want to access Windows VMs, just use RDP.
And for accessing the ESXi host, use the vSphere Web Client if you are using vSphere 6.5 or above (as a recommendation).