I am not sure about IAP, but on the controller based APs, you can have a separate AAA profile for each SSID, then send the name of the SSID in the NAS-ID. Aruba doesnt send the SSID name. Once you get the NAS-ID, you can make the decision in the RADIUS server on which group you use to auth users.
Someone more familiar with IAP can comment on whether NAS-ID is an option