As of Spring Framework 4.0.x, it is possible to send messages to a group of users by:
- explicitly sending messages to each user, using a for loop
- sending messages to a particular topic, given those users subscribed to this topic beforehand.
As you mentioned, you don't want users that don't belong to that "group" to be able to subscribe to this topic. This calls, in fact, for authorization features.
With 4.0.x, security features are implemented at the HTTP level, for example during the HTTP Upgrade phase, before clients switch to websocket (see the websocket-portfolio application).
The feature you're asking for is implemented in Spring Security 4.0.0 (to be released, see this blog post for a full preview).