Force NPS policy to accept certificates from clients issued by a specific CA on domain

Hey all,

We have 2 Certificate servers (CA) on our domain, lets call them A server and B server.

We also have one NPS server which which we would like it to accept and connect via EAP certificate only the clients that have a valid certificate issued by A server and NOT B server.

How can I force the NPS server policy (or the whole NPS server) to accept only certificates issued by A server (Currently it accepts both).

Thank you!