Bigip LTM - Virtual or hardware based?

May be these will help:

https://f5.com/resources/white-papers/big-ip-virtual-edition-productsthe-virtual-adcs-yo

https://devcentral.f5.com/questions/pros-cons-of-using-the-virtual-edition

Perhaps someone from F5 will reply to your question here in DC, but if not, try to contact sales directly to ask for their opinion.

Lately I've been a fan of BigIP VE + External HSM for SSL/TLS performance

I would use the setup above, unless capacity of 4000 series or more is needed outright. My personal opinion is that there's really not much point in going for 2000 series appliance over Virtual these days, unless rare conditions apply (no virtualization readiness etc.).

As others have said, VE's are great these days - It might depend on your company about then who "Looks after" The Virtual environment it sits on... Some companies are more comfortable having hardware appliances, and therefore defined teams/functions/owners

First question I would ask - are you doing any SSL offload, that's going to be the big factor for solution sizing.