The CAP only limits who (users/groups) can connect via the RDS Gateway (RDSG), and the RAP only limits what (servers) they can connect to. It has nothing to do with what's displayed in the RDS Web Access (RDSWA) page.
There's no way to automatically have all your servers show up as RDP icons in RDSWA, but if I remember correctly, one of the tabs of the interface allows you to specifiy a server to which you want to connect and it will launch an RDP client to that machine. This might be a configurable option, or I might be totally wrong. Unfortunately, I no longer have a RDSWA server around to test.
Ultimately, if your RDSG is visible on the network from which you're trying to connect (presumably the Internet), and policies in the CAP and RAP are setup to allow it, you can simply put the desired hostname in the Computer box of the RDP client, the hostname of the RDSG in the appropriate box and it should allow you to connect.
No need for the RDSWA interface at all in this case.
To my knoweldge, the RDSWA page is mostly used to aggregate and publish RemoteApp sources and provide a method for Windows clients to pull said links down to their PCs.