You can set a per-user bandwidth limit in the user-role.
However, if you want the user to be placed into a restricted role once they hit a given amount of MB, you'll need to have radius accounting enabled and use something like Clearpass to track the usage and then send back a radius CoA to put the user into the restricted role.