Your idea of the MGMT server being in the DMZ and the SQL server being behind a protected interface is correct: no one other than the MGMT server needs to be able to communicate with the database. 

With regards to Netscaler I've never used it so I'm not familiar, all I know is the two products are compatible at least to some extent.  Google "Autoscale: Automatic scaling in the citrix CloudPlatform" and you'll find a document on support.citrix.com describing the solution which includes using Netscaler.