Setting VPN to come from assigned IP pool

As an alternative, you can set up a separate network access resource that uses its own SNAT pool (say, with a single address) for use by the team connecting over the VPN. For example... Have an access policy that has an authenticate step (ex. using Active Directory), then a followup step that checks the local user database for the user ID and its membership in a particular group. On a match, assign it a network access resource that uses the "special" SNAT, otherwise assign the one everyone else uses. In this case, the local user database isn't authenticated against, just checked for the user and their group which occurs in the background.

The unique SNAT can be used as an "allow" IP for accessing resources, as it will show up as the user's source address. Hopefully this makes sense, I just finished getting this working myself.

Lastly, sure you can do some group membership checks in Active Directory, but using the local user database gives you more control.