apply an SSL profile in order to apply an iRule

Yes, you will need a cert in the client-SSL profile for Option 2, this will be the one the users type in the browser. THe webserver cert can be the same or different as the F5 doesn't verify the webserver cert by default.

Option 3 is also an option for you if you were only checking the client IP as that should be done with the CLIENT_ACCEPTED event (layer3) and doesn't need HTTP. Therefore you wouldn't need any SSL profiles or HTTP profiles. But this may limit you if wanted to do anything else at HTTP, e.g. ASM, cookie persistence etc..