Cisco ASA VPN and CLI auth against NPS

I'm trying to auth my Cisco ASA VPN and SSH access against the NPS, but I can't seem to get it to work for both separately.  Can I have the ASA be one Radius Client, one Connection Policy, and have the VPN access be one Network Policy and the SSH access another Network Policy or do I have to differentiate them differently?  Right now, I want to grant VPN access with a security group and my SSH access with a security group, mutually exclusive.