So, as I said in a comment, the most secure way is vnc over an ssh tunnel. It might not be the fastest because of the ssh encryption. I've just set this up on my machines, so I'll show how to set up the tunnel after you've gotten the server running.
Set up the tunnel from the client (windows) machine:
ssh -N -f -L 5901:remotehost:5901 -l remoteuser remotehost
There, easier than it sounds. Let's go through the options:
-N tells ssh not to execute a command (we don't want a shell, just the port forwarding).
-f prompts you for a password if necessary, then goes into the background. I suggest you set up a key pair for authentication, then you don't need a password and could even set this up to run at boot. Though, from a laptop you probably don't want that.
-L tells ssh to listen on this machine at port 5901 (the first), and when a program connects there, ssh sends everything it receives to itself on the remote machine, where it then connects it to that machine's port 5901 (the second).
-l tells ssh to use
remoteuser as the username. If you have the same username on both machines, you don't need this.
Note that if VNC runs on a different port (5900, perhaps), you'll need to change at least the second port number.
Now, to connect, simply type:
vncviewer -user remoteuser localhost
Again, if you have the same username on both machines you can leave out the
-user argument. If you need a different port,
vncviewer -user remoteuser localhost::localport
It may prompt you for a master password to start the vnc connection, but either way if all goes well you should see a login screen. Log in and work as usual.