...
# Restricted access to service from local and domain groups
account sufficient pam_listfile.so onerr=fail item=user sense=allow file=/etc/security/access-users-to-login
account required pam_listfile.so onerr=fail item=group sense=allow file=/etc/security/access-groups-to-login
...