Explanation
According to the Plan your StoreFront deployment document, for single server deployments you can install StoreFront on a non-domain-joined server but certain functionality will be unavailable; otherwise, StoreFront servers must reside either within the Active Directory domain containing your users' accounts or within a domain that has a trust relationship with the user accounts domain unless you enable delegation of authentication to the Citrix Virtual Apps and Desktops sites or farms. All the StoreFront servers in a group must reside within the same domain. Therefore, server groups are not supported for non-domain-joined StoreFront servers (option D). Also, according to the User authentication document, when you configure a store, you specify the type of authentication service to use. By default, users are authenticated on StoreFront.
Alternatively, you can delegate authentication to Citrix ADC or to the Delivery Controllers (option E).
Authentication does not occur at the Domain Controller (option A) or at the Citrix ADC (option C) by default.
Two-factor authentication is supported for non-domain-joined StoreFront servers (option B) as long as the authentication is delegated to Citrix ADC or Delivery Controllers.