single ip / ssl profile / iapp template

Perhaps the easiest thing would be a VIP-targeting solution. Layer an external LTM VIP with SSL offload in front of your internal application VIPs. You don't necessarily need to worry about SNI here as long as the external VIP is decrypting the client side SSL (you can optionally re-encrypt to the internal VIPs) and 2) the sites use different resolved host names.

when HTTP_REQUEST {
    switch [string tolower [HTTP::host]] {
        "owa.domain.com" { virtual oa_vip }
        "adfs.domain.com" { virtual adfs_vip }
        default { reject }
    }
}

The one significant caveat here might be if you needed client certificates at the application VIPs, which would be highly difficult to achieve with VIP targeting.