Best Practice to use Security group + NACL

Team,

I have a customer who has reached a limit in NACL (20 in + 20 out), customer can ask AWS support to increase the limit, but that will also have inverse impact on performance. Customer will have many other application coming in and will need more NACL + SG in place. Do we have any best practice to implement SG + NACL or any existing implementation in other customer places which can be referenced?