Hello Sruthi. Before moving to UI customization, I would revisit the Advanced Policy rule. Returning a violation unconditionally is not a reliable test here. IIQ can evaluate the rule against both the current identity and the projected post-request identity, and if both states violate, there may be no new violation to surface at request time. That behavior was reported and resolved by comparing the existing and expected states (related thread).
I would add logging at the start of the rule and log the entitlements from the identity passed into it. Then compare that projected identity against the persisted identity from context, and return a violation only when the request pushes the entitlement count for that application above one. There is a working example for this exact requirement here.
If you specifically need to block the second selection before Submit and show one popup in Manage Access, a plugin/UI validation would still be a good option. A similar requirement and plugin approach are discussed here.