NPS restriction of one type of 802.1x authentication for a specific access point

I have NPS running on a pair of 2012 servers, and it's authenticating 802.1x wireless connections for multiple user types for one SSID (switching vlan's, based upon user group memberships, etc.), and I'm prepending sub-domain information as necessary based upon username patterns.  but I'd like to restrict one class of user from logging into one specific access point without disabling the other types of users for that site.