Hi,
If you want to restrict the users connecting to system remotely.
Then you need to have proper network design in place and try to place the system in some secure compartment. So the user you want to give access can be opened via firewall,vpn or Citrix depending on how they access.
Yes you can restrict it via Citrix as in citrix you can control which application the user should be allowed to open.
Thanks
RishI Abrol