restrict website to only specific ip addresses on same VS

You could create a data group with the allowed ip addresses, and then reference them in an iRule, that only matches if the host header is :

when HTTP_REQUEST {
    if { [HTTP::host] equals "www.example.com" } {

        Require client ip address to be present in datagroup (dg_example.com) for allowed source ip's
        if { ! [class match [IP::client_addr] eq dg_example.com] } {
            drop
            return
        }
    }

}

Your question already provides a decent pseudo-code:

If the request is for { if client_IP is not xxx { drop connection } }

Following is a simple (untested) example. Create an internal data group of type IP called 'allowed_ip' and include all IP addresses that should be allowed to this host.

This checks the Host header of the incoming connection to see if it matches ''. If yes, it checks the client IP address. If the address is NOT in the data-group, it drops the connection. If the address is in the data-group, the iRule takes no action (connection allowed).

when HTTP_REQUEST {
    if { [string tolower [HTTP::host]] equals "www.example.com" } {
        if { ! [class match [IP::client_addr] eq allowed_ip] } {
            drop
        }
    }
}

This may not be the most optimized solution but should meet the requirement. May not need the 'tolower', but it may be good just to ensure the test matches appropriately. You can replace drop with reject if you prefer an explicit reset.