It is not a problem to have two policies, just remember that everything needs to pass both of them individually if you enforce. When one is report-only, that should not be a problem at all.