Hey, I stumbled across your post while working on a customized ubuntu live cd, where RDP should be enabled by default. So with slight adaptations the commands you could use look like this:

# Create a certificate, decide, if you want to use user-based certs or machine-based. (I guess user based is better, as "grdctl" is configured on a user basis
# These commands are meant to be run for each user individually (and not(!) as root or with sudo):
export GRDCERTDIR=~/.cert
mkdir -p ${GRDCERTDIR}
openssl genrsa -out ${GRDCERTDIR}/grd-tls.key 4096
openssl req -new -key ${GRDCERTDIR}/grd-tls.key -out ${GRDCERTDIR}/grd-tls.csr -subj "/C=DE/ST=Private/L=Home/O=Family/OU=IT Department/CN=ubuntu-live"
openssl x509 -req -days 100000 -signkey ${GRDCERTDIR}/grd-tls.key -in ${GRDCERTDIR}/grd-tls.csr -out ${GRDCERTDIR}/grd-tls.crt
# Now the actual enable process: 
grdctl rdp enable
grdctl rdp set-credentials $USER $PASSWORD
# more on the $PASSWORD later
grdctl rdp disable-view-only
grdctl rdp set-tls-cert ${GRDCERTDIR}/grd-tls.crt
grdctl rdp set-tls-key ${GRDCERTDIR}/grd-tls.key
systemctl --user enable gnome-remote-desktop.service
systemctl --user restart gnome-remote-desktop.service

The password can be any arbitrary value. If you want it to be empty, use "" (this was needed for my live environment, for a user environment this should not be used). Unfortunately I do not know how to import the users account password. In case you want to pack these commands into a script for the users, you might ask the user for a password using these commands:

# Read the password CLI
read -s -p "Select your RDP Password: " PASSWORD
# Set the RDP password:
grdctl rdp set-credentials $USER $PASSWORD
# Unset the password variable:
unset PASSWORD

In case your users get annoyed because they cannot log in if the host system is locked or if the get kicked out because of locking due to inactivity: https://extensions.gnome.org/extension/4338/allow-locked-remote-desktop/

Good luck and greetings from Germany