As per my knowledge: If your guest-WLAN uses FLexconnect, the ACL’s should be created as Flexconnect ACL so they will be checked on the AP, instead of the WLC, where flexconnect traffic does not pass through. A normal ACL is not needed in this case.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: