Better way to match different URI based on XFF and different data group with IP

Try this modified one:

when HTTP_REQUEST {
    foreach CHECK_IP [split [string map [list " " ""] [HTTP::header "X-Forwarded-For"]] ","] {
        switch -glob [string tolower [HTTP::path]] {
            "/externaluri" {
                if { ! ([class match $CHECK_IP eq DG-XFF-EXTERNAL-ALLOWED-IP]) } {
                    reject
                }
            }
            "/internaluri" {
                if { ! ([class match $CHECK_IP eq DG-XFF-INTERNAL-ALLOWED-IP]) } {
                    reject
                }
            }
            default {
            }
        }
    }
}

.