Before @RedNectar blasts you, don't use "L2outs" (aka External Bridged Networks)
It's better to use EPG Static Ports (Static Path bindings) instead which over more granular control over the respective VLANs. L2Outs extend the broadcast domain for an entire range of VLANs, but it becomes an all-or-none extension. With EPG static ports, you can extend & remove individual VLANs much easier, and control access on a per VLAN basis (think ACLs).
With this in mind, you typically would create an AEP, Physical Domain and VLAN Pool for representative of the Legacy enviornments and configure your Interfaces connecting from ACI to that environment with this AEP. From there, you can then add/remove EPG static paths within your tenant by adding the Physical domain to your EPGs, and adding the Static Port Entry. Depending on how many VLANs/EPGs you have, could be tedious, but nothing a little PostMan scripting/API magic can't make quick work of.
Robert
