how can i make irule to block port 25 on virtual server?

Yes. you can achieve via policy also. Please find the irule.

    when CLIENT_ACCEPTED {
 if { ([string tolower [HTTP::host]] equals "xyz.com") && ([TCP::local_port] == 25)} {
        drop
    log local0. "connection dropped from [HTTP::host]"
         }
    }

Do you really require a Any port virtual server.

Starting with Exchange 2013, all exchange services are on HTTPS port.

if you require it, try this irule:

when CLIENT_ACCEPTED {
    if {  [TCP::local_port] == 25} {
        TCP::respond "500 Service not available, closing transmission channel"
     }
}

Blocking a single port violates the security best practices (which are often requirements) of "least privilege" and "default deny". I would recommend turning it around and allowing only what you actually need, even on a VIP that is configured to allow all ports.