you can use group and service but in this case the CSS will nat all traffic from the services, not just the traffic sent to the CPE.

If you want to limit nating to some destination only, you need to use acl.

NQL are not really necessary.

An ACL to achieve what you need will look like this :

acl 1

clause 10 permit any destination sourcegroup

clause 99 permit any any destination any

apply VLAN...

Match the source and destination for which you need nating and insert as many clauses as necessary.

Gilles.