NPS - Secure Wireless - Radius - Computer Domain Policy

2012 R2 NPS Server

Set up WPA2-Ent to connect to NPS server for validation

It works fine if I use - User Group member of grp_Secure_Wireless  and it works fine if I use Machine Group - Domain Computers

but wont work if I use both in same policy?

I only want company owned laptops (verified as part of the domain computers) and users that are a member of Secure Wireless to be able to connect.

Need the both to be valid - so need them in same policy

Any thoughts are appreciated

Thanks

John