FreeRADIUS and Active Directory Integration

I'm sure you're reading the subject going "ugh not another one".  But there is so much documentation out there and all of it slightly different that I don't know which end is up at this point.  I would like to use FreeRADIUS to authenticate VPN users and wireless, and I'm working on VPN right now.  From what I understand so far, I want to use LDAP to check if the person is in the right group first, and if not reject them.  If they are in the right group then authenticate using ntlm_auth.  I am also understanding that the place to do this is no longer the users/authorize file and that it should be done in the 'default' file using 'unlang'.  Is this correct so far?  If so, can someone give me an example of the 'unlang' portion?