are you going to use it to restrict network access between subnets? It's not possible to map traditional network access-lists or firewalls security policies to cisco aci security model, so test it before making decision.
For example if you want to open access from some subnet to any external network (0.0.0.0/0), you can't just connect 0.0.0.0/0 external epg to your contract, you need connect all nested external epgs. So it's need to use some automation tool to link all nested epgs to contracts and then to track all created and deleted epgs to link and unlink after any changes. But you can imagine how it will affect tcam usage: if you have 100 nested consumers epg in some source subnet, and 10 nested provider epgs in some destination network, and you have contract with 4 filters then it will consume 10 * 100 * 4 = 4k from TCAM. And the total TCAM is 32k :)
