Can F5 drop IP direct access to virtual server? Allow only URL access and no ssl validate.

As HTTP_REQUEST is event always triggered after TLS hanshake, this is expected. To meet your requirement, you would need to create LTM policy with something like below settings and remove this iRule.

Let us know how testing goes.