It depends on your network requirements. If you want to exempt the source network to destination network(any) then you can use (example:- internal to any) if you want only source network could access a particular network then exempt destination network instead of any. As per the cisco, the higher zone network can access the lower security zone by default and if you want to give the access to lower zone network to highher zone network then you need access list. Create rule step by step would be in proper way. Thanks