I have been able to build a NX proof of concept that might help someone else. By default NX starts Pulse safely with only access to local applications running on that same computer. We have a use case whereby we want to allow other servers to communicate with Pulse over TCP and then route the sound to the users clients. The challenge is that each user will have to have a unique TCP port. I got it working.
The attached screenshot shows: from the NX login machine, from the prompt loaded the correct pulse module and told it to use port 4715. From another computer, I pointed PULSE_SERVER back to NX and then use the paplay command to remotely send sound.
It will be easy now to write a post login script that does this automatically when each users log in.