Hi ya,
Or to ask the question, what are you trying to track?
Dependant on which VDI platform you are using, there might be many connections (TCP) being opened up forming one or more sessions. If horizon for example that could be https and blast which is two different sessions.
Also if you are looking at auth, the f5 needs to be aware or understand who has logged in for you to be able to identify that further. I've seen it done via APM with just a pass through which sort of works as long as the same user there logs into horizon.
If you haev the enterprise license for horizon and are using the saml integration then it would be much simpler with APM, but you did mention you didn't have APM in your use case.
Another useful thing could be cookies.
You can use that at LTM, (cookie persistnace) APM and ASM and then see what that information brings.
But if you use LTM on its own, it won't be user aware. So you'll only be able to look at IP, which can be a bit misleading when looking at the VDI end, something like XFF might help but it will depend if you VDI package can read and report on XFF headers and then map this back to the user in your VDI platform.
Hope that makes a little sense!