[squid-users] NAT/Citrix

What would be the best way to tackle this kind of application? I've got
two groups of users: group A is behind NAT, and needs to use an
authentication that isn't by IP. Group B is on a Citrix server and some
users need different access restrictions. Is it possible to accomplish
both? Can it be done from a windows/IE client using implicit
authentication?

Any ideas or directions will be appreciated.

Thanks.