#2 works. I added the MR as a patch to a production site and then I was able to add an IP range to the ACL.
I applied the patch and it is working well.