Function principle of VLAN ACLs M4100

Hello there, I´m Kim and quite new to networks. Currently I´m working on ACLs on a M4100-50g-POE+ switch for our company Network.

The Setup so far is:

Internet router is directly connectd to the switch (in a separate VLAN). The Switch interconnects several VLANs (for Printers, staff, Admin and guests). These are controlled via a set of ACLs (which VLAN can interconnect with which other VLAN eg. Printers can´t open a a TCP connection but are allowed to answer etc.).

I have configured these ACLs as a Whitelist and bound them to the ports by "IP Binding Configuration" and the setup works so far. Every ACL takes care of the Ports of exactly one VLAN (eg acl 105 deals with VLAN 50; acl 120 deals with VLAN 200 ... )

I then wanted to apply the ACLs to entire VLANs to ensure that I don´t have to reconfigure the ACL binding whenever a Port is moved into another VLAN (eg. setting up a new Printer in the Printer VLAN). Thus i used the "VLAN Binding Table" for this job.

Now I´m facing the problem that while the ACLs work as intended when bound to the Ports, they do not work the same way when bound to entire VLANs: They block too much traffic unless I put "permit any any" at the end, which basically ruins the idea of a whitelist.

I´m sorry, that I can´t be more specific on this one, but is there any general advice or a particular point that I have to keep in mind when binding ACLs to VLANs instead of single ports?

If you need any more specific infos I´ll try and create some sample VLANs an ACLs to "play with".

Thank you for your help in advance.

Cheers Kim