How do you build an irule to drop connection (without completing the handshake)

Unfortunately, at this time, there is no way to drop a connection before the handshake occurs. The earliest event in iRules is the CLIENT_ACCEPTED event, which occurs immediately after the handshake is completed, and a new client side connection has been established. There have been a few requests over the years for the ability to do what you're describing and drop things at the first packet based on certain criteria, but this isn't something that is currently implemented.

If this is something you're interested in pursuing, I'd recommend providing this feedback to your sales team so that they can add more weight to the previous requests for this functionality.