Irule for Host block with custom ASM violation

when HTTP_REQUEST priority 500 {
    if { ([IP::addr [IP::client_addr] equals 10.0.0.0/8]) || ([HTTP::host] == "xyz.com") } {
        return
    } else {
        HTTP::respond 403 content "Access Denied"
    }
}

Strictly with an iRule, this should be close to what you need to allow requests from 10/8 to any host or require host xyz.com. If you have ASM, you can configure this in the policy and you shouldn't need an iRule at all.