You could assign the group based on the new feature, Advanced Session Variables. ASV's can be assigned different values based on different combinations of conditions (e.g. if variable1 == "value1" AND variable2 =! value3 then ASV = group1). The ASV value could even be set to the a URL of a webtop, or the literal name of a resource group which you could then map "verbatim".
We use this to map some of our partners to different resource groups based on what IP address they come from, and some can come from several different IP addresses, but we assign them using a combination of OR statements:
CONDITION
session.network.client.ip == "001.002.003.004" OR session.network.client.ip == "005.006.007.008"
VALUE
"literal_resource_group_name"
Not meaning to sound harsh, but I cannot agree that the Firepass is not flexible. I evaluated all the market leading products before going for Firepass, and it was head and shoulders above the rest in this department, and it has only gotten better since then (v6.0.1). ASV's are a particularly powerful feature.