SGT to block access between IP pools in same VN

[techno.it]

Hi Folks

I have a VN in fabric which got two IP pools

and I want block the communication between them using SGT. 
Users get authenticated to network with 802.1x using MAB and machine authentication.

However, I don't want to make user groups on ISE but do SGT subnet mappings

I want to give a tags to the subnet so once user connect to network, it cannot with other VLANs in same VRF

How this use case can be achieved?

[M@rco]

Hello techno,

you can select a default SGT per IP Pool within the host-onboarding configuration. If ISE doesn´t reply with another SGT, SDA will use this default SGT per IP Pool.

[techno.it]

M@rco 

Could you share any configuration guide that might be helpful?

[M@rco]

you still need some?

[Mike.Cifelli]

Take a peek here as there are a ton of valuable resources shared: https://community.cisco.com/t5/networking-documents/cisco-sd-access-fabric-resources/ta-p/4196271