WRT the pre-block ACL, you are correct. Your current production ACL name would be used so that the sensor reapplies it after a shun has been completed.
WRT added two interfaces to your IDS, it will depend on how and what you want to shun. If you simply want to block troublesome IP addresses from the Internet, setting up incoming shunning on the interface that connects to the Internet will do the trick. If your desire is to prevent users / systems on your network from doing nasty thing s to anything connected to the other side of the router, then a similar configuration on this interface is appropriate. IMHO, the only time you'd use both interfaces is if you're trying to shun a very specific activity from going through the router (say, for example, telnet usage).
I hope this helps,
Alex
