Ldap-Group and EAP

I have trouble to set up some authorization upon ldap attribute of the user: I have different SSID for my wireless LAN, using WPA or WPA2 with EAP/TTLS and ldap auth which work fine right now with Freeradius How can I prevent user without some ldap special attribute to get authenticated on a special SSID (which is send with the access request as: Called-Station-Id = "00-12-34-56-78-90:SSID" ) ???