We have a WPF Application that has a two flavors with a consistent UI etc,one that runs from a Windows OS Desktop and one that is supposed to run as an XBAP application.
To run the XBAP application, your client also needs to run .NET framework. It's not possible to run XBAPs without .NET Framework installed.
By default only partial trust permission is granted to your application. To enable FullTrust, you either need to grant the permission to your application URL on the client:
caspol -m -ag 1 -url "http://server/app/*" FullTrust -exclusive on
or you could add the security certificate to the client trusted certificates. A step by step guide is available here: How to run WPF - XBAP as Full Trust Application.