UPDATE 13.11.15: I have a beta version ready, will announce soon with screenshots and features.
The replacement of Citrix Web Interface, StoreFront , does not allow configuring two factor authentication directly on the web interface, you will need NetScaler (virtual or physcal) if you want strong security.
I have a raw prototype of a two-factor authentication system with self-enrollment supporting newest version based on freeradius and StoreFront web API, I am planning to create a system that supports Mobile-OTP and Google Authenticator, however I do not have any Netscalers available to properly test.
Let me know if you are interested in testing this solution : emin at huseynov.com