IPsec VPN RA

When we migrate from SSL VPN to IPsec VPN, we currently use different firewall policies based on user groups to separate access for each vendor. In that case, would the firewall policies be configured as follows?

config firewall policy
    edit 1
        set name "vendor1"
        set uuid xxx
        set srcintf "ssl.Internet"
        set dstintf "Internal"
        set action accept
        set srcaddr "SSLVPN_TUNNEL_ADDR1"
        set dstaddr "SERVER1"
        set schedule "always"
        set service "RDP"
        set utm-status enable
        set logtraffic all
        set groups "vendor1"
    next

edit 2
        set name "vendor2"
        set uuid xxx
        set srcintf "ssl.Internet"
        set dstintf "Internal"
        set action accept
        set srcaddr "SSLVPN_TUNNEL_ADDR1"
        set dstaddr "SERVER2"
        set schedule "always"
        set service "RDP"
        set utm-status enable
        set logtraffic all
        set groups "vendor2"
    next
end

But if we use IPsec VPN, do we need to create separate IPsec profiles and assign each profile to a different client IP address range based on the user group? Also, would the firewall policies then be applied only based on the client IP address range?

 edit "vpn-vendor1"
        set type dynamic
        set interface "port2"
        set local-gw xxx
        set mode aggressive
        set peertype one
        set net-device disable
        set mode-cfg enable
        set ipv4-dns-server1 10.10.10.10
        set proposal aes256-sha256 aes128-sha1
        set dpd on-idle
        set dhgrp 20 5
        set xauthtype auto
        set authusrgrp "vendor1"
        set ipv4-start-ip 10.20.1.10
        set ipv4-end-ip 10.20.1.200
        set ipv4-split-include "10.0.0.0/8"
        set unity-support disable
        set dpd-retryinterval 60
    next

edit "vpn-vendor2"
        set type dynamic
        set interface "port2"
        set local-gw xxx
        set mode aggressive
        set peertype one
        set net-device disable
        set mode-cfg enable
        set ipv4-dns-server1 10.10.10.10
        set proposal aes256-sha256 aes128-sha1
        set dpd on-idle
        set dhgrp 20 5
        set xauthtype auto
        set authusrgrp "vendor2"
        set ipv4-start-ip 10.20.2.10
        set ipv4-end-ip 10.20.2.200
        set ipv4-split-include "10.0.0.0/8"
        set unity-support disable
        set dpd-retryinterval 60
    next

In short, when using SSL VPN, we only need one SSL VPN profile for all user groups. However, with IPsec VPN, does each group need its own IPsec profile?