AppRF functionality for the 3000 series controller is visibility only (see Colin's post below regarding 3200 vs. 3200XM). You can only enforce policy (ie. block) on the next generation controllers, 7000 and 7200 series.
You'll need the PEFNG (Policy Enforcement Firewall) license for any role/firewall functionality regardless.