Selective Access within Application via iRule

You could use an irule.

If everything under say /Application/Administration/ should be blocked and /Application/PasswordReset/ should be allowed then perhaps the irule in this thread might be what you are after.

https://devcentral.f5.com/questions/block-url-49989

Just have your datagroup as

class blockthis {
    "/application/administration/"
    "/application/anotherblocked/"
}

and change equals to starts_with in the evaluation

when HTTP_REQUEST {
    if { [class match [string tolower [HTTP::uri]] starts_with blockthis] } {
        drop
   }
}

/Andreas