Enroll devices using alternate upn suffix and configure Citrix Endpoint Management to use a domain suffix for authentication.Refer to Citrix documentation - Citrix Gateway and Endpoint Management