adding AD group filter to tomcat Realm configuration

I have configured my tomcat application to authenticate against my company LDAP.

Here is the realm configuration looks from server.xml file:

    <!-- enable LDAP authentication -->
    <Realm className="org.apache.catalina.realm.JNDIRealm"
      connectionName="serviceaccount@company.com"
      connectionPassword="some-secret"
      connectionURL="ldaps://example.com:636"
      alternateURL="ldaps://example.com:636"
      userBase="DC=company,DC=com"
      userSearch="(&amp; (objectcategory=person) (objectclass=user) (sAMAccountName={0}))"
      connectionTimeout="30000"
      userSubtree="true"
      adCompat="true"
    />

This works well.

Now I am trying to add AD group filter to restrict login to users who are part of AD group "g.sales_excecutive".

I am not sure where can I add that. I tried adding this with (sAMAccountName={0}) but that didn't work.