Freeradius with AD

Hello, I'm new to this, so please show mercy on me.  I managed to get Freeradius to work with AD. I have one SSID setup at the moment on the controller.  So far any user with AD credentials that log into our wireless, gets connected.  My boss wants me to tweak the system a bit to separate staff from students.  We have an OU for staff and another for students.  The problem I have is I have no idea where in radius do I configure this option.  We want to be able to tell radius that if a student logs into for example to the staff SSID they are rejected but if they log into their student SSID, access is granted.  How do I make that happen?  Thank very much for any help you can provide.