iRule assistance

! is shorthand for "not", so yes any IP not in your datagroup will be blocked

For the extra page I'd consider using starts_with as it's more efficient than contains, and since you're doing a string tolower maybe set the lowercase path as a variable.

Something like this should do it

when HTTP_REQUEST { 
    set lcpath [string tolower [HTTP::path]]

    if { ($lcpath starts_with "/heartbeat") or ($lcpath starts_with "/health") } { 
    if { !([matchclass [IP::client_addr] equals private_net])} { 
     discard 
        }
     }
   }