Computer Configuration > Administrative Templates > Citrix Components > Citrix Workspace > Client Engine
Machine
HKLM\SOFTWARE\Policies\Citrix
This policy allows session launch from Citrix-signed executables only. It blocks session launch from any other untrusted processes and disables direct session launch using the ICA file.