Was just going through the community questions and noticed this was answered.
Sorry for the delay.
You're right, there's no such thing as ANY for SGACLs.
If the ACL using ANY is on an interface then you can determine what subnet(s) are on that interface in order to perhaps use a Subnet:SGT mapping instead.
Remember that in your example above, the IP will be in a group. So what you want is a policy from SGT X to any other group (permit or deny as appropriate). You then complete your policies between all groups making use of a default deny or default permit, whichever allows less entries to be entered. Remember you can use the 'Unknown' group for sources or destinations that are not classified into groups.
