For the record I work for Cisco and my comment is in support of the blog.

One of the main concepts about ACI is "whitelist policy" which means servers belonging to distinct EPGs are connected to interfaces on the same physical or virtual switch are not allowed to communicate unless there is a whitelist policy to allow communication between these end point groups. In other words, EPGs (end point groups) need to be be configured to allow traffic between them. This is what we call "Zero Trust Model". This is unlike traditional data center switches where servers communicate unless blacklisted. This means all traffic is allowed unless otherwise specified.