An ACI administrator has an existing contract between the Web-EPG and App-EPG that permits all TCP traffic. A new security requirement mandates that TCP port 23 (Telnet) be explicitly denied between these two EPGs while all other permitted TCP traffic continues to flow. The administrator wants to apply this exception without rewriting the entire allow contract. Which ACI construct should be applied to enforce this specific deny?