@capo I'd also add here that if you go with the Citrix tools they aren't "just" from Windows Update, you'll need to actually run the installer either way, the drivers can be kept up to date via Windows Update but still have to install the agent so you can properly control/manage the VM.
I personally say go with the Citrix if you need secure boot, right now I believe you can't secure boot VMs with XCP-ng tools installed. Unless that changed and I somehow never saw news about that.