If the number of users is larger, you could either have a dedicated scheduler that only authorized users can access or you could write a wrapper for condor_submit that checks that the user is allowed to set the group to cms.
If you're willing to upgrade to HTCondor 8.3.5, you should also be able to use submit requirements to prevent users from submitting jobs as the "wrong" group.
- Todd Miller