If you want this to be applied to USERS and not CLIENTS. you can for example make a group in AD for those who will have different bandwidth. Then you can set up your NPS and Server Derivation rules so that those users get the different role.
This will also be easier to administrate in the long run as you only have to give a user membership in the group in stead of entering/deleting MAC addresses. :)