irule to select different SSL profiles based on the Client IP address

Yes, which SSL profile is used is determined by the iRule. You don't need to configure a default one, though it doesn't harm anything if you do.

For what it's worth, I'm using such an iRule for a purpose similar to yours:

when CLIENT_ACCEPTED { if { [class match [IP::client_addr] equals "private_net"] } { SSL::profile A } else { SSL::profile B } }