Guest VLAN ACL's?

Hi all,

First time poster in here.

Need some guidance with ACL's.

I have a remote site with a Cisco C887VAG. It's connected to an MPLS link and we run BGP.

Site is on a 10.100.0.0/20 local network split up into a few VLAN's. One of them now need to be for guest WiFi. AP's are Ubiquiti.

Everything I read suggests I need to ACL off all the networks it shouldn't access. Is this the only/best way? We have so many random remote sites there would be at least 16 deny statements.

Looking for any guidance of the best way to do this.