Docs on Windows Server and Dynamic ACLs

I would like to do a few labs on access control using AD and Users/groups. As an example, using dynamic ACLs on APM to control what resources a user connected though a wentop/VPN can reach. If user A logs in though VPN and is a member of the VPN Users Group, ACLs in AD users group should control what assets in the network he can reach (Classic ACL like destination IPs and port number). These ACLs (F5 format or Cisco format) can be stored in AD, on the DC for example - but how do you configure it? I have a hard time finding docs that explain the Microsoft-bit of the configuration. Does anyone have any tips on where to find info on this?