I google this long time, and saw may guys has this requirement, but no any direct answer. So I shared my experience at here, acturally just add new groups in conf/acl.auth.php as below:

You can see it in ACL manager: