restrict access to a vs by a datagroup but temp allow exceptions and log

Sanjay's example is good, but as Nikoolayy1 pointed out, this can be done more efficiently with a local traffic policy. Initially, the policy might like this:

(tmos)# list /ltm policy reject_disallowed_ip_addresses
ltm policy reject_disallowed_ip_addresses {
    last-modified 2021-04-10:15:59:01
    requires { tcp }
    rules {
        reject_disallowed_ip_addresses {
            actions {
                0 {
                    log
                    client-accepted
                    write
                    facility local0
                    message "tcl:Dropping connection for client [IP::client_addr] not in datagroup"
                    priority info
                }
            }
            conditions {
                0 {
                    tcp
                    client-accepted
                    address
                    matches
                    datagroup disallowed_ips
                }
            }
        }
    }
    status published
    strategy first-match

When you are ready to actually reject the traffic, change the log action to Reset traffic at client-accepted.

With respect to what the value setting is in a datagroup entry, it is optional and would allow you to associate some value with the key portion of the entry. In your case, you do not need it.