To force all users to authenticate at the Gateway and not be able to log in directly to StoreFront.

Instructions

The following changes would need to be made in StoreFront for the store where Gateway only authentication is required:

1. For the specific store, enable only the "Pass-through from Citrix Gateway" option from the Manage Authentication Methods settings.
 


2. For the specific store, confirm that the correct internal and external beacons are configured under the "Manage Beacons" settings. Since the requirement is to force all users to authenticate through the Gateway, the internal beacon specified should be unreachable, this will always send the Workspace users to authenticate at the Gateway.
 

https://support.citrix.com/article/CTX223882/faq-configuring-authentication-at-storefront-using-netscaler-gateway