The "need to know" basis for admit is a bit hard for me to understand. I would put it like:

The suggested way is to selectively admit access to hosts or subnets. It is also possible - but discouraged - to admit all hosts (by admitting a "/0" subnet) and deny specific hosts.