Privilege for operator on LTM

Yes that would work, but as you know, Irule manager can just create/modify/delete Irules, he cannot map it to VS. So that would mean you would be required to have some dummy Irules created already on the VS. But this is really going to be a concerning one if it goes in the production setups, because this maybe messing up a bigger Irule logic.

If your intention is to restrict users to one particular application alone, you can go with 3rd party vendor who manage F5 devices.