Using OpenBSD's pf.
Question: How can we modify the firewall of OpenBSD to allow ONLY a given group for network access? If somebody isn't in that group, it shouldn't have layer 3 or layer 2 network access.
Assuming you are talking about workstations “behind” the OpenBSD box, you’ll want to add the workstations’ IP addresses to a pf table and create appropriate rules that reference this table. `man pf.conf’ for details. As for layer 2 access, you might want to elaborate a bit more here in terms of your requirements.