Configuring VS to access LTM

No. In order to use APM in front of the BIG-IP management GUI, to achieve 2FA, you're going to have to create a standard LTM virtual server with an access policy. In that LTM virtual server you're going to have to apply an HTTP profile, the access profile, a client AND server SSL profile, and the aforementioned iRule. I'm not quite sure what you mean by "management VIP". You can't use the BIG-IP VLAN self-IPs here.

client -> standard HTTPS APM VIP -> iRule -> BIG-IP management port IP:443

Instead of a load balanced pool, you're using an iRule with the node command to send the traffic to a specific IP: the management port IP. And because the management port is only listening on HTTPS 443, you need a server SSL profile on the LTM/APM VIP.