In v4.x you could create an ordinary CLI user with a custom UID and then use sudo to allow access to certain commands. In v9.x this was removed. Now all CLI users have to have UID=0 (When I say have to, F5's response was that only UID=0 is supported) and there is now no sudo.
In other words, there is currently no way (Short of compiling up a statically linked copy of sudo yourself for a 64-bit Linux and installing it) to do what you want.
In 9.4.x it's supported to have web users with restricted access to certain groups of VS's, Pools etc... But still no CLI separation.
Nimbostratus