Allow a VPN client user (ACS) to log through only one group

Hi,

I’m trying to set up an IPSec VPN server, by means of a PIX 515 or 1841 Cisco router, to let remote users access my LAn by means of Cisco VPN client.
I’m using Radius (ACS windows) for users AAA, and I have provisioned groups and users on it.
I need to establish different tunnels for different user groups, that is users of group 1 should be log in my network only through tunnel1, and users of group 2 should be only through tunnel2.
VPN works, but…. how to prevent users of one group to log in my network by using tunnel that belong to other group. I other words, how to prevent users of group 1 to log im my network using tunnel2.

Looking forward from anyone reply.

BR
Genci Pojani