mrc02_kr is right, I think.
+ : root : ALL
+ : (group_name) : ALL
- : ALL : ALL
But this leaves out an important step: you have to tell authconfig that you want to enforce PAM access control. Before doing this, the access.conf file does nothing.
* A WORD OF CAUTION: *
What I am about to describe works on my systems, but it is very dangerous, and may leave you locked out of your system if you do it incorrectly or your setup is different. Take the precaution of having an open console session to repair problems. If this is a VM, take a snapshot. Make backups. Use a test box before doing it an anything you care about. Do not reboot while having problems. As I have no FreeIPA experience, this might bork up your setup. You have been warned. OK, back to the answer:
First, I made a backup of my authconfig:
authconfig --savebackup authconfig_working_outofbox01
Next, I added a local group for accounts authorized for ssh (but I am fairly sure that this will work for groups in FreeIPA... but not 100% sure. I have used a configuration using a LDAP group... it has just been a while.)
Next, I updated the acces.conf file, adding:
+ : (ssh_auth) : ALL
- : ALL : ALL EXCEPT LOCAL
Next, I edit the file: /etc/sysconfig/authconfig, changing
Lastly, tell authconfig to update:
Now test every user type to be sure you got the results you wanted. This seems very under documented on the internet, making me think that few shops use this. I like it as a solid step in hardening systems.