Yes, but only with legacy Citrix Receiver 4.9 or older (not recommended).
Poorly. It was designed for desktop browsers with ActiveX/Java. Use Workspace app instead. xenappweb
Isolate it in a legacy VLAN, force HTTPS, disable TLS 1.0/1.1, and restrict IP access. Yes, but only with legacy Citrix Receiver 4