Separate owa and active sync?

I have OWA and active sync hitting the same vip. Both are working fine. We want to add RSA 2FA to just the OWA part. I have the RSA 2FA working in my lab for OWA. I can't find a way to apply the APM rule for RSA to just the OWA traffic and allow the active sync traffic to go through without the RSA authentication.