We have a WPF Application that has a two flavors with a consistent UI etc,one that runs from a Windows OS Desktop and one that is supposed to run as an XBAP application.
To run the XBAP application, your client also needs to run .NET framework. It's not possible to run XBAPs without .NET Framework installed.
By default only partial trust permission is granted to your application. To enable FullTrust, you either need to grant the permission to your application URL on the client:
caspol -m -ag 1 -url "http://server/app/*" FullTrust -exclusive on
or you could add the security certificate to the client trusted certificates. A step by step guide is available here: How to run WPF - XBAP as Full Trust Application.
I have worked in a similar situation of using ClickOnce as the engine to deploy the binaries as XBAP as well as standard WPF. To install the XBAP website at a customer site, we would have an installer create the virtual directory in IIS and then run a custom step to sign the ClickOnce manifests. This step was necessary as the application needed to access a generated configuration file that contained information about the customer environment.
Here are some notes on issues that I've seen with using XBAP.