V1910/JE009A: Using ACLs as a poor man's IP Source Guard

[n3mmr]

I want to set up a basic ACL or set of ACLs to
Permit source addresses in the range 10.0.28.1 to 10.0.31.254 to enter a port range.
Permit DHCP DISCOVER packets, that have the source address set to 0.0.0.0, to enter that same port range.
Deny all packets with other source addresses inbound access on that same port range.

Because most of the people looking after this network are very uncomfortable with CLIs, I really want to be able to do that in the Management Web GUI.

But I have so far been unable to do this in the GUI: In the CLI I seem to have gotten it to work with a single basic three-rule ACL and then that as a packet-filter on a port.

Help!

[n3mmr]

I think I know, now:
Setup basic acl's for the permit patterns
Same for the denial patterns
Set up classifier(s) using the permit acls, same for the deny acls.
Define a behaviour that has filter permit set, and one that has deny set.
Set up a QoS policy that uses the permit class and behaviour first, and then the deny ditto.
Finally associate this QoS policy with a set of ports, inbound.

Am I right?