You will want to use a combination of role-based access, radius returned attributes (in your case group=a, then Role/Vlan = xx, group = b, then Role/Vlan == yy)
I would suggest you have a look through the user manual in the area of 'server derivation rules' and 'radius attributes' as starting points.