How can a Citrix Engineer ensure that external users connect only to specific desktops through a NetScaler Gateway?

A session policy assigned to users on NetScaler Gateway governs session parameters such as ICA proxy mode and client experience settings, but does not restrict which specific Delivery Groups or desktops a user is permitted to access.

A StoreFront VIP on NetScaler Gateway is a network-level load balancing construct for directing traffic to StoreFront servers, and has no role in controlling which desktops are enumerated or accessible to external users.

Creating an access policy assigned to a Delivery Group allows the administrator to define SmartAccess filter conditions - such as requiring the connection to originate from a specific NetScaler Gateway - and bind those conditions to a targeted Delivery Group. This ensures only users connecting through the designated gateway can enumerate and launch the restricted desktops, enforcing access control at the broker level rather than just the UI layer.

A StoreFront filter can control which resources appear in the store UI but operates only at the presentation layer and cannot enforce broker-level access control to prevent users from reaching unauthorized desktops.