Question on K03010204: Configuring BIG-IP APM NTLM authentication

I am deploying sharepoint 2016 with NTLM authentication for computers on the domain. My question is in reference to what the article calls the APM virtual server. Is the APM virtual server the actual application VIP or a seperate authentication virtual server like an IDP for SAML?

Here is what I understand:

1.) Create the NTLM Machine Account.

2.) Create the NTLM Auth config.

3.)Create the ECA iRule.

4.)Create the access policy.

Here is what I do not understand.

1.) Create the virtual server. (Is this simply the VIP that is servicing the application?)

2.) Add the ECA profile to the APM virtual server. (Again does this refer to the VIP that is servicing the application?)

The last part of the article says to add the virtual server hostname to the Local Intranet Sites list. Which sounds like the VIP that is servicing the application. Please let me know if I am correct in my assumption. Thanks.