Which server-based authentication protocol would be best for an organization that wants to apply authorization policies on a per-group basis?

TACACS+

Explanation:

TACACS+ or terminal access controller access-control system plus is an open standard protocol developed by Cisco. It encrypts all communication in a network ( including the password and data sent) and supports a separate authentication, authorisation and accounting policies for access to a centralised database.

It also uses the transport layer protocol TCP for a reliable data communication.