Securing OWA using APM from Outside for specific users

No irules necessary, you can build both pieces of logic inside of your Access Policy. For groups, you can just use "AD Query" or "LDAP Query" and success branch from that if the group name appears in the response. For IP address checking, you can use a similar technique to branch from a result by checking the client IP session variable.