There is a special device called the ACLX device and you are right, it acts as the initial GK until you set up your storage management environment. Historically this was the VCMDB device and actually contained the contents of the volume masking database. An FA may participate in host sharing (the typical configuration). The ACLX director flag must be enabled for this to occur. When the bit is enabled on the FA, the host HBA WWN is checked against the ACLX database and only the devices it is allowed to see will be presented. Alternately, a host may be presented point-to-point (direct connect). In this case only one host can use the FA and so no volume masking is required (the FA does not need to check the ACLX database). Sothe ACLX bit is disabled and the host gets to see all devices that are mapped to the FA.  Note that the ACLX device is typically mapped to all FA's initially. All hosts will see this device. On initial setup, you can get your san management host(s) set up with their own GK's, then you can unmap the ACLX to prevent all your production hosts seeing a device they don't need to.
I'm looking at a VMAX in DMZ requirement at the moment and am having some confusion around ACLX.  Looking through documentation and forums I can see multiple mentions of ACLX,  but with different contexts.  ACLX Gatekeeper - Appears to be a preset Gatekeeper for initial array configuration,  before gatekeepers are created and presented manually.  ACLX Director Bit - This is listed as being a pre-requisite for a port participating in a port group (auto-provisioning groups)  I am assuming they are two totally different things with unfortunately similar names.  Can anyone shed any light on this?
ACLX bit / ACLX Gatekeeper - are they one of the same thing