Thanks
Under l2/mac I have one test rule - with just one mac in it that is set to allow only the stations listed below.
Under Device access I have one item
it says deny all by default.
Not sure what else I need to do. But it is currently letting anyone on.
Found it you have to go to the ssid, go to advanced, then select the ACL rules