For User specific data security have a look at Section Access. [Passing a parameter to the url gives no security]
I do not know of any benefits for using Citrix. All the End User client needs is a Web browser.
My experience of Citrix has been with MS Office applications and the like, but I don't think QlikView Desktop will work in that way. The QlikView way is to deploy your application to an Enterprise Server, which end users access through their web browser. You'd need to do more research into licensing appropriately for your number of users.
Section Access can then be used to limit sections of data to the intended audience, as per Bull's link.