I have an Aruba IAP and we enforced all VLANs to that AP so basically, it handles 6 VLANs now. We are currently using Role derivation which will allow an employee to connect to a Single SSID but will get a different IP (If an employee is in the sales department, he/she must be connected to the domain "SALES")using the device's mac address. As you mentioned, I should use the RADIUS Server in assigning user roles. Are there any steps on how to do the same function that we have right now with the RADIUS Server?