VIP Integrate SSL VPN

Dear,

I managed to successfully integrate VIP with SSL VPN Cisco.

I'm just a question.

- All users Active Directory has access to the Self Service Portal;

- All users Active Directory can register a token from the Self Service Portal.;

- All users can access the VPN;

How to restrict VPN access to certain users?

I can perform this control through the VIP?

Or this control is carried out by the ASA (CISCO)?

Below my settings:

Can anyone help me?

Thank You.