C90LEW lockdown

C90LEW lockdown

New to Wyse thin clients as of a week ago. The goal is to:

1) Provide access only to Citrix published application(s) (probably via PNAgent). I saw a thread here on doing this in WE7, but there wasn't much detail.
2) Have Citrix log in automatically (employees don't know user/pwd of their stations)
3) Have SIP soft phone client run at logon, but not allow access to taskbar icon (I've successfully installed and tested the sip client)
4) Roll out above to numerous devices (I have WDM installed and am working through initial config today)

Can anyone provide pointers? The more detail the better. Thanks.