I have inherited a TP Link Omada setup and am trying to setup segregation between VLANs.  I've started by creating firewall rules to deny traffic between the different VLANs, however, I need to be able to allow certain management devices access to specific IPs on other VLANs, but when I try to create an ACL of type 'LAN-to-LAN' the only 'source' option is to choose a network, not an IP Group or a single IP.

So, my question is - how do I allow one or two specific devices on a VLAN access to either an entire VLAN, or access to another specific device?