Can I use Active Directory to restrict access to a VS/Pool/Node?

In the absence of the ability to identify AD group membership at the proxy layer (with something like APM), you're likely best option is securing resources at the application and/or IIS layer as Patrik relates. You could technically use some form of signaling mechanism between the application and an LTM iRule, but that wouldn't prevent initial access to the application and would probably be a reasonably complex iRule. APM will do all of this out-of-the-box.