Citrix FAS Passwordless Authentication Intranet
Citrix FAS with StoreFront load balanced access through Netscaler - NO Gateway. Two subordinate CAs for HA. Passwordless authentication to Citrix with ADFS.
Now just add Netscaler nFactor for external access and pray this doesn't break without any specific reason or when you'll patch/upgrade it. Very secure configuration but issues I saw with ADFS or W10 2004 is something to have in mind before going production.