IP Intelligence with LTM /APM

I am publishing email HTTP and SMTP through F5 and if the email is having any attachment , if it is clicked by end user it establishes connection with botnet.

By using IPI ( integrated with LTM/APM) can i protect the outbound botnet from the end user to the internet ( like connect to CnC), as per the attached diagram , only using LTM it can be done. But practically I have integrated IPI with WAF and AFM , I am quite not sure the ATP ( enduser to internet) protection like botnet CnC can be protected using IPI and LTM design.

Can someone throw some lights on this . please.