how to disable a particular EAP type in freeradius2 for a particular ESSID ?

[Riccardo Veraldi]

Hello,
I have a radius infrastructure with multiple ESSID.
in particular I have the eduroam ESSID and another local ESSID.
They are managed by my freeradius2 server with 2 virtual-server 
instances, one for eduroam and the other for my local ESSID.
Both are 802.1x infrastructures.

I have always been disabling EAP-TLS in my local infrastructure writing 
this in the users file

DEFAULT    EAP-Type == EAP-TLS, Auth-Type := Reject

but now I need EAP-TLS to be avaliable for eduroam and I do not like the 
solution to have a completely different radius server,
I wanted to do it with only one freeradius server with virtual server 
configuration.

Thus I need to enable EAP-TLS for eduroam and disable EAP-TLS for my 
local SSID.

How is possible to do this on freeradius2 ?

After many attempts I could not figure out...

thank you

Rick