You need to set up a service user account that does not have desktop access to enable services such as scanning. The reason you would want to set up a domain user in the first place for scanning is to avoid licensing charges, and as a security best practice.
Create the user in Active Directory
Add the user to the security setting of the 'Access this computer from the network' security policy under User Rights Assignment:
The user account can be created as a standard Domain User.
Citrix Published Desktops on CloudConnect