VPN with radius (2FA) and AD groups - different ACLs

Hi

How I can filter traffic policies based on users validated through radius servers?

I have two Duo radius proxies each of them on different ports and with lookup to two different AD groups.

But I can't figure out how to implement it - the only way that I could see working is having another VPN listener on a different WAN IP and linked to a specific radius -> AD group

But is not very flexible if I need more groups

Thanks

Felix