Just define two separate IngressRoutes:

- one using a hostname match, low rule priority, requiring authentication

- the second one uses a hostname and ClientIp match, high rule priority, bypassing authentication