apm question

If the Radius auth is returning this group information to you, it should be available in session variables. I don't remember which session variable this would be in, but you could essentially add an Empty agent in the visual policy, evaluate on the value of this session variable in the branch rules, and then assign different resources to different branches. Something like this:

expr { [mcget {session.radius.last.attr.groupid}] equals "sales" }