Casey,
we found that the only way to prevent some Citrix users from using C2O connection is to uncheck their C2O setting 'Login at Start'. If the user action to uncheck manually is not acceptable, then setting can be changed programmaticly in a C2O configuration xml file located in %userprofile%\AppData\Roaming\Docuware\Connect to Outlook\ folder.
This way only some Citrix users will have C2O connected.