Just added a new policy to the Internet Authentication Service – Remote Access Policies to not allow users of the “novpn” AD group to use VPN.