From the documentation:
group-list Indicates to the router which Content Engine IP addresses to allow packets from.
redirect-list Sets the access list used to enable redirection.
With the redirect-list you can configure access-lists on the router to deny or allow certain ip addresses to use WCCP redirection to the CE. Don't forget that there is an implicit 'deny all' in the access list. So if you use an access list to deny certain ranges, don't forget to have last statement 'access-list ip any any'.
