You're up late.
I'm not an expert on PEAP and it's requirements/limitations with AD, but I do know the other bit:
In ACS create a group with no access, create other groups as normal.
Under External User Databases, create the database under Database Configuration.
Map the groups under Database Group Mappings - defaul group is "No Access", specific mapping for the group you want to allow.
Make sure the Unknown User Policy specfies that it checks the windows db.