You can also assign the role based on attributes like this,
And then in the role you can force it to a particular vlan.
If you send back the attribute Aruba-User-Vlan it seems it won't automatically be in the vlan, but you could do it like this as well.
But alas, in each case you can't specify the vlan to be 3333.
I've tested all the above and works well. The Instants are certainly coming along, compared to when they were first released.
Hope that helps.