The VLANs already restrict Layer-2 traffic "frames" from VLAN to VLAN.
Your ACL you applied directionaly on the VRI (Virtual Router Interface) controls Layer-3 "packets" from traveling Subnet to Subnet.
Yes, I completely realize that placing a an IP /W Mask on a VRI ads that subnet to the device's routing table as a directly-connected route available via that VE interface.
***Let's say you have this:
vlan 123 name Ruckus-Wireless-Forum-Example by port
untagged ethe 1/1/1 to 1/1/24
router-interface ve 123
interface ve 123
port-name VRI often called SVI by some other vendor whom shall remain nameless
ip add 10.0.0.1 255.255.255.0
ip access-group Break-Everything out
ip access-list extended Break-Everything
deny ip any any
From any Interface 1/1/1 to 1/1/24, you will STILL be able to transmit data WITHIN Vlan 123, so if you connect two computers say on port 2 and 17 and do an FTP or Windows Workgroup file-copy etc. it will work just the same as if there was no VRI ever assigned.
That said, 10.0.0.1 IS WITHIN Vlan 123
, so it will be reachable, too from any IP within that subnet connected 1/1/1 to 1/1/24
Specifically, you need to visualize it mentally as a little-guy standing on that interface inside the router (or switch), and the little guy is ONLY concerned with traffic that actually passes through it whether that traffic is coming IN vs going OUT, the little fellow knows there are two sides to every interface. It's easier to think of it back in the day when routers had IP addresses assigned to physical interfaces; they still can but more and more it is Layer-3 switches all around.
Hope this helps.