Hi - Yes, I had found that also.   Its a shame it cant be set per user once logged in.....Hope the modules help !

As a curveball, you could try my PowerShell modules for ACI that I'm working on (at https://github.com/kevsterd/ACI-PoSH)  ...  Depends on your skillset but if you are used to VMware's PowerCLI or PowerNSX it may be handy. Not at all finished but it ...

Why dont you VLAN off one of the (spare) ethernet interfaces and apply ACL's accordinglyThis works well and gets around this 'lil loophole