L2 port security

Can you provide a drawing of what you're trying to accomplish? I'm not sure I follow what you're saying. For the LTM to receive traffic from your pvlan hosts, it will need to be connected as a promiscous port since your two hosts are (I assume) configured in isolation mode. I personally prefer the vACL approach for controlling intra-subnet traffic for two reasons. 1) configuration is straight forward, making it easy to troubleshoot, and 2) there are some serious holes in pvlan from security perspective.