How to allow nas'es to serve only groups of clients?

Hi. I have two types of nases: 1) hotspots 2) vpn servers. I need vpn nases authorize only vpn users and hotspot nases authorize only hotspot users. How can i divide users into several groups and reject vpn accounts to login through hotspot and vice versa? I think i must use huntgroups and unlang, but not cleanly understand how. -- ISP CrIS, Softwarium