Have the RADIUS server assign users in different departments to different VLANs. Apply firewall policies based on IP ranges.

Have the RADIUS server send different roles for users in different departments. Apply role-based firewall policies.

Create multiple zones on the MM. Assign different departments and sets of firewall policies to different zones.

Create a different WLAN and SSID for each department. Apply different firewall policies to each WLAN.