When applying ACLs to a VLAN, that is effectively the same thing as applying the ACL to all ports that belong to that VLAN. Note that ACLs applied to a VLAN do not touch traffic that is routed into or out-of that VLAN locally.
In EXOS, it's generally easier to apply ingress ACLs vs Egress ACLs as Egress ACLs have more restrictions, less hardware availability, and egress ACLs are not supported on all platforms.
If you're trying to prevent client A from reaching things in network B, it's generally acceptable to apply an INGRESS ACL on the client port, or as close to the client as possible to reduce how far that traffic goes before it's dropped. Alternatively, you could use an EGRESS ACL at the router for network B if you're unsure of where traffic will be ingressing.
Regarding your specific example:
I would apply an ingress ACL to the guest VLAN with a bunch of deny rules that prevents those clients from reaching other networks (via destination-address match condition). Then the permit all at the end will allow for Internet traffic as you suggested.
Hope that helps!