How to allow users to log in under a specified security group

Hello WDNJSQ,
You can modify the user filtering parameters of the user import policy, and use the name of the security group to which the user belongs as the matching condition. In this case, users belonging to the security group will be updated locally. Then, configure the new user option to select "Do not allow new users to log in".
Before the modification: (&(|(objectclass=person)(objectclass=organizationalPerson))(cn=*)(!(objectclass=computer)))
After the modification: (&(&(|(objectclass=person)(objectclass=organizationalPerson))(cn=*)(!(objectclass=computer)))(memberOf=CN=SSLVPN,CN=Builtin,DC=ngfw,DC=com))
I hope it helps!