Only one dynamic ACL or policy can be added to a VPP. Ingress LVPPs apply to traffic flowing from the VM, into the switch port, and then to the client. Egress LVPPs apply to traffic flowing from the client, out the switch port, and to the VM.
For instructions on creating policy files, see Policy Manager. For instructions on creating dynamic ACLs, see ACLs.