You would do this outside of horizon, we use sourced based routing of the load balancer, so certain ip ranges go to a pair of uags. You could probably do rules based off mac address in some firewalls, but that process isn't the best, that only works for devices that are connected directly to a switch.