We want to separate internal and external access to separate stores. Laptops that have internal store added using GPO don’t work when remote since remote access is not enabled for the store. To resolve the issue, we have remote access turned on for internal and external store. How to set remote access to external store only?

In your scenario i would prob go with a single store with a single FQDN for the store with internal/external access enabled on store then rely on beacons to control if users are internal or external

Why separate the stores? If you have external connectivity on the netscaler gateway fronting the storefront, then it will autoswitch between the 2, just make sure the netscaler and storefront urls have different hostnames.

We want to hide certain application internally/externally using keywords