Configuring Cisco IOS with Windows 2003 server Radius for Proxy

I am currently running Cisco IOS VPN with Radius Authentication everything is fine. I need to implement cisco Authentication Proxy for a user group or user based authentication and policy selection. Basically if user from group admin wants to go online he authenticates and does anything he want but user from different group to be blocked or have different access lists applied. Any one know how to do it?