Authorize based on the destination IP

We're running a virtual lab (with freeradius as our AAA server) and we have users that at specific points in time should be allowed to access some devices in the lab but sometime later, when they swap out their experiment, we need to deny access to those devices. How can I do this? Thanks in advance, -Ana