F5 APM - Group Resource Assign How to?

I want to provision LDAP Group Resource Assign allowing Active Directory groups to be assigned APM resources. How can i make fallback deny if no matching groups are found? The branch rules have no options for this failed resource assignment

Does anyone have a successful LDAP group resource assign they can share when a group is not matched? or point me at F5 documentation for this feature :(