02-19-2016, 06:21 PM
I'm mostly 3.x at the moment. Let's not get to code specifics 
In login, just before a successful login redirect, can you get the group of the newly logged-in (but not yet served anything) user from the user object? (line 62 in 4.0c)
If so, you can add an errors[] entry and do a (naughty) break out of the block. Or better, redirect to a new 'naughty step'.
One way you will have refused entry, the other you have them in a sandbox.
In login, just before a successful login redirect, can you get the group of the newly logged-in (but not yet served anything) user from the user object? (line 62 in 4.0c)
If so, you can add an errors[] entry and do a (naughty) break out of the block. Or better, redirect to a new 'naughty step'.
One way you will have refused entry, the other you have them in a sandbox.