after adding "update reply {

        Huntgroup-Name := "%{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress='%{NAS-IP-Address}'}"

}"

to my sites-enabled/default I do see the queries in the debugging information checking if the supplied user is part of the Huntgroup however when this is not the case the user still get's access:

How do I reject when a user is nog in the appropiate Huntgroup? Thanks in advance!