Mappings are checked from a top-down perspective, so if you have the \DEFAULT domain appearing below the ESMLAB domain then this should be OK. What's probably happening is that ACS is unable to get any of the users windows group mapping properties and therefore doesn't know that they're in the VLANx Windows group. Because of this ACS always maps them through to the catch-all \DEFAULT group and they get no access accordingly.
As for why ACS can't get the users group mappings from Windows is usually a permissions problem, specifically in what user the CS services are running under on the ACS device, most often even a domain administrator doesn't have the right permissions. You don't mention if ACS is running on a DC or just on a member server. Running it on a DC usually resolves most permissions problems, particularly on an AD.
You can try the following to set the permissions correctly:
Instructions for changing privileges:
1) on the AD, go to Administrative Tools -> Domain Security Policy ->
Security Settings -> Local
Policies -> User Rights Assignment and
a) double click on "Act as part of the operating system"
b) check the "Define these policy settings" checkbox
c) Click add and enter : "domain\adminstrator"
d) Click Ok
e) double click on "Log on as a service"
f) check the "Define these policy settings" checkbox
g) Click add and enter : "domain\administrator"
h) Click Ok.
(Note: do the same for "Log on Locally")
2) Right click on "Security Settings" header and choose "Reload"
3) log into the ACS Machine with user = domain\administrator (please note that
the user must be
administrator and not another Domain Admin user).
4) Change the ACS Services to run under domain\administrator and restart them
all.
If that doesn't work, enable Full Logging under System Config - Service Control page, and restart the ACS services. Then try an authentication request, and check the latest auth.log file under the Program Files\CiscSecure ACS v3.3\CSAuth\Logs, there'll probably be some errors about not getting RAS permissions. You may need to send this to the TAC for further analysis.
