Two different sets of Group Authentication

Hi, Currently I am authenticating only One group of users in Cisco Switches group. Now, I have to add another VPN group and distinguish between two sets of group autentication , VPN Users, and Cisco switches. I'd like to control access to each of those separately (different AD Groups SIDs). Do i have to do somethinbg like creating two modules (ntlm_auth and ntlm_auth2) or two different mschap modules with respective ntlm_auth entries? Even then how would it differentiate between the two? Is defining huntgroups an option if using ntlm as Auth type? BR, Raheel