What version of AOS are you using ?
In 6.3 or 6.4 you should be able to apply it under the User-Role
You have to be careful when you apply this for an AP-group because that means that all users attached to that AP will only have available that amount of bandwidht which could really impact the wireless performance.
You are probably better off doing it by user or role.
How do you have your VAP configured ? Tunnel or Split-Tunnel
You could have it set to split tunnel so that not all the traffic comes back to HQ and the internet related traffic will stay local.