Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
As per my knowledge: If your guest-WLAN uses FLexconnect, the ACL’s should be created as Flexconnect ACL so they will be checked on the AP, instead of the WLC, where flexconnect traffic does not pass through. A normal ACL is not needed in this case.