2 F5 appliances connecting to 9K with dual vPC (PCI Vlans and non-PCI Vlans)

"A physical requirement to separate"

This is why PCI is such a pain. People do silly things and jump through nonexistent hoops to try to make some non-technical pencil pusher happy. And I know this is not a requirement you created so I apologize for the mini-rant.

Run trunks to the F5s and land the VLANs in their own route domains on the F5. ACI should create ample separation once you hit the 9ks. For the record this is not required by PCI and is just going to make life more annoying and raise MTTR. :(