Require membership of more than one group in firewall policy

Hi,

I am using user groups in firewall policies.

I am wondering whether it is possible to  require group membership in more than one group for a policy to be accepted.

Example: User Z has to be member in group A AND group B for policy X to allow traffic to flow.

Alternatively, is it possible to restrict SSL VPN access to certain groups in any other place, but firewall policies?

Thank you very much