How to create a user certificate for use with a Net Scaler device

Good Day,

I am looking to understand if this is possible. We have a large number of external users who will be given an internal user certificate to be paired with a NetScaler device to access our Internal SharePoint environment. The NetScaler will have our complete chain installed to it in order to validate the users who are requesting access to the SharePoint sites. While I understand the process to create a template on behalf of another user, what I don't understand is how can I generate this user certificate so it does not have the Issuing or the Root certificate in the chain? 

Basically, we are looking to pair the user certificate with the chain present on the NetScaler device, thus granting the user access to the internal SharePoint environment.

Is this possible?

Thanks!