Just to update, we now have the VSZ up and running, but not using the AD groups feature. We've switched to using a RADIUS server through our smoothwall.
For all those waiting on the AD groups feature, it is now included in the software, version 22.214.171.124.296 is what I'm running, it's the last option when you configure a AAA server.
On the downside though they have removed the section under roles where you can limit a role to individual WLANS, this screen on the ZoneDirector. So kind of give with one hand, take away with the other. There must be a way to replicate with with traffic profile mapping but I haven't looked at that.