The hosts are not connected to the same vlan

it must have routing config to communicate between them

The group is not the same so it is the problem

Check your groupings and routings

Maybe they don't share the same subnet.

Configure Vlans then assign to the users

First of all, you need to identify your own requirement, you want to have VLAN gateway on switch? or NGAF?

Scenario 1
If you want to have a VLAN gateway on your switch, you must first create a list of VLAN databases and network segmentation, and those VLANs must point to the NGAF's default gateway, which must create a Layer 3 interface and an IP address on the NGAF itself and the switch, and the NGAF must have a return route to your switch.

Scenario 2
VLAN gateway on NGAF, in the same step, list all your VLAN and IP Segmentation, and your NGAF acting as gateway for those VLAN, which means your user/server point to NGAF IP as gateway, and the switch only needs to allow all trunk the VLAN you configured. In this case, your switch operates in Layer 2 mode, with no routing configuration or Layer 3. This is the simplest way to set up a network, but keep in mind that you must allow inter-vlan communication in the firewall to ensure that all traffic is reachable.

So conclusion, you need to finalize your VLAN, how many VLAn you want? what are IP segments you want? which gateway you want? either NGAF or switch? at least you need to have your own design document and baseline to start configure.

you need to identify your own requirement; you want to have VLAN gateway on switch? or NGAF?
for VLAN Gateway:
If you want to have a VLAN gateway on your switch, you must first create a list of VLAN databases and network segmentation, and those VLANs must point to the NGAF's default gateway, which must create a Layer 3 interface and an IP address on the NGAF itself and the switch, and the NGAF must have a return route to your switch.

For NGAF:
VLAN gateway on NGAF, in the same step, list all your VLAN and IP Segmentation, and your NGAF acting as gateway for those VLAN, which means your user/server point to NGAF IP as gateway, and the switch only needs to allow all trunk the VLAN you configured. In this case, your switch operates in Layer 2 mode, with no routing configuration or Layer 3. This is the simplest way to set up a network, but keep in mind that you must allow inter-vlan communication in the firewall to ensure that all traffic is reachable.
In short, you need to finalize your VLAN, how many VLAn you want? what are IP segments you want? which gateway you want? either NGAF or switch? at least you need to have your own design document and baseline to start configure.