Hi,
I don't think you need an ACL, just tag your ports with the voice vlan and untag the ports in the data vlan(s) then use LLDP to advertise the voice vlan to the handset.
configure lldp port [all] advertise vendor-specific med policy application voice vlan [voice-vlan] dscp [dscp]
The phone should accept the LLDP advertisement and drop the phone into the correct vlan.