very simple. first setup your user groups in your nt enviroment. In ISA, change the access policy/protocal rules. Generally by default, there is one rule. Take a look at the current rule. "Applies to:" is the area to look at. Here you can set to groups / client sets, which would be blocks of ip addresses, ect.
Change the default to administrators, and make new rules for your user groups.
Hope this helps.
Also take a look at isaserver.org for more tips on ISA server. It's were I learned most of what I'm doing so far.