APM combine check for ldap group plus IP ACL

Hi,

A client wishes to create an APM policy that will, amongst other things, do the following - 

The client has a group of users that have to meet two conditions to access the resource.

We need to check in combination that the user is both a member of an AD group and that the group also matches an IP ACL.

Can this be done using only APM, and if so, how?

Or do we need to combine an IRULE and if so, is there a simple way to do this? (we have 30 groups that need to be matched to ACLs).

Thanks,

Vered