The guide to secure Team foundation server to use HTTPS (for example exposing it on the internet).
available here.
There is a simpler (??) way that doesn't involve configure the ISAPI filter that is using an ISA server (we have been running that setup with TFS 2005 quite successfully). I wonder why Microsoft doesn't document it. I wonder if it is unsupported. :-)