Yes, restricting by group is exactly what we did. Needed some work configuring the groups though since they have to be dynamic in our case.