My issue in the Single-Sign-on (SSO) used by Kerberos Constrained Delegation when we redirect the traffic to the F5 load balancer.

In your setup, do you also use the Azure AD Proxy Connector or do you want to replace the Azure AD Proxy Connector with the BIG-IP? If you use both the Azure AD Proxy Connector and the BIG-IP, I think you don't need to use an APM Access Policy, because Kerberos Constrained Delegation is performed by the Azure AD Proxy Connector.