If you want to publish desktops via XenApps, the users must be in the “Remote Desktop Users” builtin group. This only allows them RDP access via ICA.
Once VDA is installed, a new group called “Direct Access Users” is created and only its members are allowed direct RDP access.