Exchange iAPP

Neither of those features can be configured through the iApp template.

You will need to take the iApp out of Strictness and make the necessary manual changes.

Alternatively, you could try using the process described in

K13315545:  Configuring a BIG-IP ASM virtual server to protect a BIG-IP APM login page with brute force prevention

to apply a layered virtual with ASM/source IP filtering prior to passing the traffic to the iApp-configured virtual. However, I have not validated that this will work, but it seems like a good avenue to try. I'll also note that some of the Exchange requests (RPC calls, for example) are not suitable for ASM evaluation, and should bypass ASM.