On Mac you need to enable Remote Login and Screen Sharing.

Note: If Remote Login is not starting with message “Remote Login starting…” you might need to manually add a launch daemon:
sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist

On Windows run Powershell and create encrypted SSH tunnel. Replace USERNAME with your user name and MAC_IP_ADDRESS with IP address of your Mac.

ssh -L 25900:127.0.0.1:5900 USERNAME@MAC_IP_ADDRESS

Now use a VNC client (eg. RealVNC Viewer) and connect to 127.0.0.1:25900. RealVNC will still complain about unsecure connection but the connection will be local only (127.0.0.1).