I have a customer that wants to set a requirement for "compliant device" for all apps in using Entra ID. Has anyone solved this without adding exceptions on the rules for Citrix Servers? Is it possible to get a "compliant device" state by enrolling the servers in Defender for Endpoint?

Checking for compliance - assuming using Conditional Access - means the device needs to be enrolled in Intune with a compliance policy (CP) assigned. That CP can use signals from Defender. However I don't think you can apply CP to servers. Personally i would hybrid join them and use that as a Grant control or TrustType Filter exclusion in Conditional Access.