How to deny access to Switch Cisco by Group

[Usuário do Sistema]

Hello,
I have just installed a  FreeRADIUS Version 2.1.12. it's integrate
with OpenLdap and I'm able to use it that way.
 my issue is how to deny users aren't member of the any group.
 For exemple, I should like authorize users do login in the my devices
Cisco from a group of the my data base LDAP. if user doesn't inside in
that group the freeradius must DENY it. currently my freeradius is
allow any user from LDAP. if the user is created on LDAP it's able
login in my Cisco devices.
how to deny access by group ? if user is member of the group it's able
login in otherwise the user is deny

thanks