You need one if customers have accounts on your system, if you host content other people submit, if you provide network access to the public, or if you operate anything where somebody could misuse your service in a way that creates exposure for you. Absent those, an acceptable use policy is a document describing rules for a situation that does not exist, and the terms of service and privacy policy cover what you actually need.
Where it earns its place, the job it does is give you grounds to act. Without stated rules, removing a user, deleting content, or terminating an account is a decision you have to defend from first principles. With them, it is enforcement of terms somebody agreed to. That is the whole practical value, and it is why the useful ones are specific about prohibited conduct and about what you may do in response.
The related document more businesses actually need is an internal one covering how employees use company systems. What may be installed, whether personal use is permitted, what happens to accounts when somebody leaves, and expectations about handling customer data. That is a different document from a customer facing policy and it becomes relevant with your first employee rather than with your first user.
If you do need one, resist assembling it from templates without reading them. Policies copied from large platforms describe scenarios irrelevant to a small business and omit the specific thing you actually care about, and a policy nobody has read is one you will not think to enforce. Shorter and specific to your service beats comprehensive and generic.
This is general information rather than legal advice. For most first year businesses the correct action is to note that this becomes relevant if you build something other people log into, and to spend the effort now on the documents that apply immediately.
If your situation does call for one, write the enforcement into it rather than only the rules. What you may do in response, whether warning is required first, whether you may remove content immediately, and what happens to somebody's data when an account ends. A policy stating what is prohibited without stating what follows leaves you deciding the consequence during a dispute, which is exactly when a written position would have been useful.