RADIUS Server + Directory Server: Restrict auth to specific Directory Group?

I'm spec'ing out a new RackStation deployment for my small company and have a question about the RADIUS Server package. Short version: Can I configure the RADIUS Server package to only authenticate against a certain Group/OU in the Synology Directory Server?

Long version:

• I would like to manage Users and Groups through the Synology Directory Server package.
• VPN access will be handled by the network gateway, which will authenticate users against the RADIUS Server, which will be configured to point to the Directory Server.
• I don't necessarily want all accounts to have access to the VPN. Ideally, I'd set up a "VPN Access" group and have the RADIUS server authenticate only users in that group.

I haven't found much info about this online, so I'm thinking that maybe it's not possible through the GUI, but perhaps there's a config file that can be adjusted? Not being able to restrict auth to a specific Group/OU wouldn't be a deal-breaker, but it would certainly be preferable.

Thanks!