A different SSID requires a unique/additional Virtual AP (VAP)... not an AP-Group.
SSIDs when broadcast are visible to any WIFI enabled device... that is the way the 802.11x standards function. You may choose to hide the SSID/suppress the broadcast but then you have to manually configure the SSID (don't make a spelling mistake ;)) on each client.
The most scalable approach will be to use authentication (whether that is a pre-shared key you give only to the intended users, or a radius transaction and only allow users a,b,c or user-group d,e,f onto the network) rather than trying to limit broadcasting.