Device Identification Advice

I'm trying to set something up that I'm having a hard time figuring out. What I'd like to do is create an SSL VPN with two groups. One of the groups would be domain joined devices, and the other non domain joined devices.

I want to be able to restrict the destinations that the non domain devices can only get to very limited areas on the network, while domain devices have more access.

MAC filtering really isn't an option, as this is for a customer with hundreds of domain laptops and I don't want to be on the hook everytime someone can't logon and wants me to check their access after hours, plus it would be a huge pain having to keep all the laptops up to date in the firewall as they got new laptops.

Has anyone set up anything like this before? Any suggestions are supremely appreciated! Thanks