VPN L2TP over IPsec user group policies

I configured a VPN L2TP via IPsec on a Fortigate (401F). To manage authentication I used FortiAuthenticator that connects to a OpenLDAP server. Radius is used to connect Fortigate and FortiAuthenticator.
In the end of the configuration all works but now I have a problem, that´s because I have 2 different user groups and I want to make different firewall policies (manage access) to each group. Let´s imagine a group "students" and a group "teachers", both authenticate via L2TP but with different accesses.
How can I create different policies based on the group of the users?