Filtering traffic on managment interface

Hi all,

 

I am writing a build standards document for out BIG-IP estate, there is a requirement to filter traffic on the management interface (I kno you can filter https/ssh) but we need a more granular level. Can we do this without AFM or another FW sat infront of the managment interface?

 

Many thanks.