Im on a on-prem admin but Ive been assigned a Citrix Cloud task but...honestly, no idea. A client, using Citrix Cloud, has told us they want to limit access to their portal via IP. What are they talking about the "Cloud Netscaler" or what?

There are two portals..the admin portal and the Workspace portal users use (think StoreFront in the cloud). So first clarify which one they mean. If they are using Entra authentication this can be done by using a conditional access policy against the enterprise app registration.

The Workspace portal. They use AD+Token.