Use input plugin with "submitter" to limit permission for user.

and put the AD group "company-group" s submitter's value.

"company-group" has several sub groups, say "sub-gp1", "sub-gp2" etc

user who is in the "sub-gp2", cannot be authenticated, 

user directly in the "company-group" is authenticated.

should not be users in the sub-groups also have the same permission as users in "company-group"?