How to health check of web service behind authentication portal

The way you've gone about this with the webdevs is indeed the most typical way this is approached. If the URL they've provided does reflect the actual health of the service then that's great.

It gets better because that enables the webdevs to take their own servers out for service through manipulating that page instead of asking you to remove pool members.

Better whitelist the F5 local non-floating ip addresses on the application as this IP addresses are used for monitoring and the real client traffic is using the floating self ip addresses if Automap is configured or the SNAT pool (even with standalone F5 devices not in HA you can configure floating IP addresses so that SNAT automap to not use the non-floating IP addresses that will then be just used for monitoring).