VPN P2S authentication with especific enterprise certificate

I solved that the vpn client p2s will work with intelligent cards, but I haven´t can solved that the p2s vpn authorize especific client certificates, not all the issued by the CA indentitied by the root certificate registered in the p2s vpn definition. How I make that only especified certificates can will connect with vpn client to p2s vpn gateway, not all certificates issued by root certificate?