How to deny access to Switch Cisco by Group

Hello, I have just installed a FreeRADIUS Version 2.1.12. it's integrate with OpenLdap and I'm able to use it that way. my issue is how to deny users aren't member of the any group. For exemple, I should like authorize users do login in the my devices Cisco from a group of the my data base LDAP. if user doesn't inside in that group the freeradius must DENY it. currently my freeradius is allow any user from LDAP. if the user is created on LDAP it's able login in my Cisco devices. how to deny access by group ? if user is member of the group it's able login in otherwise the user is deny thanks