Question about users accessing Published Apps and Desktops

We are in a trial now of RAS. We started by creating a template from an existing server, adding it to a Pool and then creating an RDSH host. Where I am confused is how do we assign users to the desktop or published apps from that pool? Is it just based on who is in the Remote Desktop Users group inside the host VM or is it done from the console? Thank you.

 

When you create the published desktop in the console, you'll have the option to add a filtering rule. Add the rule to 'Allow if user or group is' and search for your AD user/group. Change the default to Deny if no other rule matches. The published desktop icon will only appear for the users in the group.