Citrix is a more of a server-based computing solution than it is a security or access solution like a VPN. Citrix does have some nice security features that give you some of the same functionality as a VPN solution, but it is primarily a solution for application hosting. When you need to centralize management, access, and/or resource utilization for your applications, Citrix is a fantastic solution. If you need to provide secure, controlled access to network resources, then VPN is what you need. I'll rate the solutions per your query, but bear in mind that the ratings are my opinion based on other solutions I have implemented and may or may not be right for your situation.
SECURITY: VPN, it is designed specifically for security and gives you better security options and more interoperability with other security-based systems.
COST: VPN, it is generaly less expensive than Citrix, but when you pay for Citrix, you are paying for all the added functionality (other than security) that Citrix provides. If you need the Citrix functionality, then it is definitely well worth it, but if you don't, then you can save a lot by using a VPN solution,
EASE OF USE: VPN, I have set up both Citrix and VPN, and VPN is generally easier to set up. If your implementation is <20 users and you can get them all on a single server, then Citrix can be relatively simple to set up and maintain. If you have many more users and you start getting into server/applications farms with multiple disparate applications, load balancing, and resource utilization management, then it can get very complex/maintenance-intensive and probably should not be attempted by anyone who does not have a lot of experience with Citrix. Of course VPN deployments become more complex as they scale, but not (in my experience) to the same degree as Citrix deployments.
Good luck with your deployment,
Roger
