Single VS ACCESS::Enable/Disable Vs Dual VS

I have a setup where I need to either:

 

• use one single VS with APM and use the access:enable/disable whenever required.

APM has to be disabled by default and enabled on certain conditions

 

• use two VSs, one wihout APM and forward requests to the second VS on certain conditions.

Which setup would be optimal high load usage?

 

P.S: I have an issue with the dual VS setup where the client cert authentication does not work. https://devcentral.f5.com/questions/ssl-vs-redirect-to-ssl-vs-with-client-cert-authentication-58475