Ok, if your RRAS doesn't suppport access-control, then you have to use your switch for that. As I said, you won't get any performance improvements in optimization. My advice would be to group your ACL in a way that is as much readable as possible. With that it's not that likely to make configuration-mistakes as it is the case with optimized ACLs on routers where an often heard advice is, that the entries that match often have to be moved to the top.
An optimization that is possible and quite useful is match your users to ip subnets on the RRAS based on function. If for example all restricted users get an IP in the 192.168.8.128/28 range (which is 192.168.8.128 to 192.168.8.143) then you only need one line each for your permits and denys on the switch. And you don't have to touch the switch when a new user is assigned the restricted role. In the same way you configure a range for unrestricted users.
--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni
