iRule to restrict public users to a specific service URI, whilst allowing internal users to access anything they like (along with

Untested, but the logic should work. Apply that iRule to your TCP/443 VS (test in QA first).

when HTTP_REQUEST {
  if { not ([HTTP::path] eq "/SelfService" ) and not ([class match [IP::client_addr]] eq private_net ) }{
    HTTP::respond 302 noserver Location "https://[HTTP::host]/SelfService" Connection Close
  }
}

To enforce the explicity use of HTTPS, just apply a HTTPS redirect iRule to your VS that's listening on TCP/80 port. You can use _sys_https_redirect (one of the default iRules). If you don't have a dedicated TCP/80 VS yet, I recommend to create one so that you have two Virtual Servers with the same IP, but with a different port number.