prevent users to access URL using IP

An easy way would be to leverage the black list feature in AFM (which is including in Better and Best licensing bundles). If you don't have AFM then you can leverage an iRule that looks for IPs inside a data group. You could base the code off this example but instead of setting reqBlock to 1 just reset the connection right then - no need for the ASM_REQUEST_DONE event.