Hi Tony,
Vlan assignment via RADIUS would be a good option to achieve this.
In case users do not have a dot1x supplicant, you may also want to consider MAB to still be able to authenticate them via RADIUS and assign vlans.
Alternatively, for non-dot1x capable users, you could also look into th guest vlan feature, but this won't allow you to differentiate vlans: it'll use the same vlan for all guest users.
Regards,
Fede
--
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.