How to allow specific group users only to auth

Hello Everyone, We have freeradius server with freeipa server backend for ldap authentication. Currently we able to use and login freeipa ldap accounts using freeradius, each every user available on freeipa ldap is able to login in all devices where ever we configured freeradius. Some of the devices like network devices we want to restricted only specific users (group users) are allowed to login. I a very new to this i tried but i am unable to figure out where should i mention/put restriction to check users group and allow to login. Thanks, Mohiddin.