A J2EE client of an EJB is normally another EJB or a
servlet. Typically, you would build and deploy an EAR file on the EJB Server for both client-side and server-side code. Even if the client is remote, you can gain efficiencies by enabling the EJB Server to pass-by-reference - only possible if the client and the EJB are in the same EAR file and in the same JVM.
The user may be using a browser to send requests to a JSP or servlet and to receive HTML responses. This is a case of a thin client in the sense that the PC will have no client code on it - just the browser. I think this is rather confusing because you can say that there are two clients: the browser (which knows nothing about the EJB) and the servlet (which does know that at least one EJB is servicing requests).
An external client, ie one which is external to the application (which may or may not be outside the EJB Server), must be remote and will have its args passed by value, meaning that objects are copied and passed. This client might be a Java program (possibly Swing), a Web service, an EJB of another application. If there is a client machine such as a PC, it will have code installed in it (a thick client).