set default dscp on ingress, while doing policer markdown

[0115aaaaa]

I'm using C3850, and want to set dscp AF21 for the first 100 mbps of input traffic on a L3 port ("no switchport"), and set AF11 for the remainder (any traffic >100mbps).  I am not trusting DSCP of ingress packets, but generally they are dscp 0.

I see that I can use a 2-color policer, with "conform action transmit" and "exceed action set dscp table my-markdown".  Within that table, it looks like I can rewrite all matching traffic (>100mbps) to AF11 ("default 10", or "from 0 to 10"). 

But I'm not sure how to set DSCP for the "conforming" traffic.

[0115aaaaa]

can "set qos-group" be used for this?

table-map set-af21
 default 18

table-map set-af11

  default 10

policy-map myMap

  class class-default

  police 100m exceed-action set-dscp-transmit dscp table set-af11

  set qos-group dscp table set-af21

!

interface gi1/0/1

  service-policy input myMap

...would that first set all traffic received using table set-af21, then let the policer markdown traffic out of profile (>100mbps) to AF11?