I have configured an EAP-TLS wlan. I have configured the radius server to assign a vlan to the user depending of the user group.In this way I avoid that an user with a valid certificate that discover another SSID can change the VLAN changing his SSID...