Thanks, but that article seems to focus on setting it up for your organization.
However, in this case it is some external party that just decided to send us an encrypted message this way. We do not use this functionality within our organization, but articles seem to suggest that a receiving party only needs a compatible app to read it. No extra infra settings needed.
User is able to read the email in an Outlook client outside of Citrix. It only refuses to work for the Outlook app within Citrix (OWA opened within the same Citrix sessions opens the e-mail just fine). I still think it's a compatibility issue somewhere but I'll keep looking.