Your issue here is that you have a single authentication means (and a common authentication database) for all 3 groups. Because all of your users are authenticated against the one source, if the users possess all of the different group files (profiles) they can authenticate in any of the groups defined on your concentrator.
You can get around this using radius/IAS. They way that you do this is:
define a different radius server by ip address for authentication on each of your groups.
On your radius server, define three different NAS's by IP address to represent your three groups on your concentrator. Set your IAS policies so that users from each NAS will ONLY be accepted if they are also a members of a WINDOWS group called (whatever you want the group called)
Create the 3 groups in your windows domain, and assign your users to them
NOW, the hard part is that between your concentrator and your windows IAS box, you have to perform a heap of network address translation so that the request from the VPN concentrator to the 3 "separate" radius ip addresses have destination NATed to the address of your windows IAS, whilst having source NATed to the 3 different group addresses. My network is a hybrid of routers/FW1/Pix/Gauntlet and Cyberguard, so I have a few ways of doing this, you'll have to make do with what you have. Also, watch out for Radius packet-level authentication, as this sort of thing can make it complain.
