If I understand your question I believe you are looking for the "Aruba-User-Vlan" RADIUS attribute. If your RADIUS server returns an arbitrary VLAN number as that attribute the controller will place the client in the VLAN independent of SSID/Virtual AP settings.
In my FreeRadius test environment I have following in the post-auth phase that occurs at the end of a successful EAP-PEAP authentication conversation:
# VLAN override
if ("%{sql_radius:select count(*) from wpa_vlan where username=lower('%{SQL-User-Name}') and macaddress=lower('%{Calling-Station-Id}')}" > 0) {
update reply {
Aruba-User-Vlan := "%{sql_radius:select vlan from wpa_vlan where username=lower('%{SQL-User-Name}') and macaddress=lower('%{Calling-Station-Id}')}"
}
}
In my test case I'm successfully placing users in an arbitrary VLAN that is not part of the normal pool and I'm doing it independent of any set role.