When setting up a Entra ID connection, it seems we have to use a Citrix account, not an admin account that has a entra id idp. Has anyone gotten around this? Ideally I do not want citrix accounts to have admin access in Citrix Cloud, as it doesn't seem possbible to restrict their logins in any sensible way.

It is your "break glass" account. How could you get into your Citrix Cloud Connection if Entra is down.

Fair enough, just wish they added some login restriction features

You make the password extremely long and complex and store in a vault to only use in case of emergency. Trust me, you will be grateful for it when Entra is having issues.