Allow access to vendor Group from APM to Specific Vip on a LTM

You could create an access policy that references a redirect iRule if the user has passed authentication, but that would be pretty easy to bypass (by going directly to the other virtual server). Alternately you can simply assign the relevant pool to the access policy so that it makes a load balance decision as normal once APM authentication has been passed.