I now have a requirement to restrict access to any randomized Locally Administered Address (LAA) on a particular switch port.

In creating a MAC group in the controller, there is no way to specify a mask for the MAC address which is needed to keep the number of group entries down to 4.  By default, the system inserts a mask of ff:ff:ff:ff:ff:ff for all entries as can be seen when examining the running config of the switch.

The workaround is to eliminate the switch ACL in the controller and create a new device CLI for adding the ACL to the switch.

Please consider adding a Mask field in the Add MAC Addresses window of the controller.  The default mask of ff:ff:ff:ff:ff:ff could be automatically filled in so the user does not have to enter anything but it would give the user an opportunity to make changes.