Assuming you trust that the 20 remote computers do not have viruses that will affect your network, the frame relay should be directly connected to your internal network. For more security, you can add them to a DMZ network or a stand alone connection to your firewall, but the first option is the most common. Server 2008 has a Read-Only Domain Contoller option that would be the best way to put a domain controller at the remote office. If you do not have any 2008 domain controllers and do not intend to get any, you can just count on the reliability of the frame to keep domain access with your remote users. If you don't want to trust the frame, you will need to at least make sure the remote site has the physical security required to place a live domain contoller there.

Assuming you trust that the 20 remote computers do not have viruses that will affect your network, the frame relay should be directly connected to your internal network. For more security, you can add them to a DMZ network or a stand alone connection to your firewall, but the first option is the most common. Server 2008 has a Read-Only Domain Contoller option that would be the best way to put a domain controller at the remote office. If you do not have any 2008 domain controllers and do not intend to get any, you can just count on the reliability of the frame to keep domain access with your remote users. If you don't want to trust the frame, you will need to at least make sure the remote site has the physical security required to place a live domain contoller there.