Re: How do you manage these?
1) Chrome OS Management licences are a bolt on per-device that let you manage them from the Google Management web console for the Google Apps domain they belong to.
2) Pass. There are two factor options available, e.g. the Google Authenticator app on your smartphone, but I'm not sure that's one of them.
3) As well as the Citrix Receiver there's also Ericom's Access Now that can run TS within a browser window via HTML5. Unless I'm completely misremembering VMWare had an HTML5 client in the works as well, that's quite possibly finished now.