L3 switch that can also filter traffic with ACLs on VLAN interfaces, Budget is a concern.

[yareweusingrip]

Hello,

First let me apologize if this is the wrong place to ask; I didn't know where I should post this and would be happy if someone could direct me to the right location.

Now that I got that out of the way let me paint my setting really quick. We currently are using 2910al-24G  (J9145A) as the core for a small business. This switch is performing inter-vlan routing for us. We are looking to introduce some ACLs that can be applied to VLAN interfaces. Currently, our switch is only capable of applying ACLs to physical ports. This complicates things. 

Currently are looking at an ARUBA 2920 SWITCH SERIES switch. With that in mind, I don't quite know the capabilities of the switch and would greatly appreciate if someone could shine some insight on these switches for me. I've looked through the datasheet and wasn't 100% sure if this switch could perform exactly what we were looking for: ACLs on VLAN interfaces. If someone could confirm that this switch would be capable of performing that feat we be immensely grateful. 

Other viable options we currently are looking at were: HPE 3500 and 3500 yl Switch Series. These are no longer being sold but seem to be able to perform the task we are looking for. Would prefer to buy new over used anyways. 

Other options we considered: HPE 3800 Switch Series. Does what we want. Can stack. VRRP (probably overkill for our environment).

If someone could confirm for us that the Aruba 2920 are able to perform the feat we are looking for I would be eternally grateful. If not, what are your thoughts and opinion about going for HPE 3500 switch series as replacements? 

Thank you,