Hi,
with the lack on information provided, It is hard to give definitive answers.
If you can provide more information on the network design it would be a help.
Here are some things to check.
Are users who cannot connect are on the same AP as the users that can?
For users who can not connect to the internet you will need to check the IP address that the clients are getting.
If the SSID is on a different VLAN from the Management VLAN for the AP's then the issue could be
that the switch ports may not be tagged correctly. This would evident if the clients that cannot connect to the internet are not getting the correct a valid IP address for the SSID.
Hope this helps.