Well that kinda depends on your needs doesn't it. I assume when you say
"Citrix" you're actually talking about delivering Outlook that way, which
might be more trouble to setup and support than OWA but will work better for
heavy outlook users.

Both can be very secure or not very secure at all, depending on how you set
them up. Again, what are your requirements here - if you're worried about
security then where exactly do you see the threat coming from? I presume
when you say that the sites are connected to one another through the
internet you are talking about a site-to-site VPN and all traffic would flow
over that?