You can use the
pam_succeed_if module in your stack to provide exceptions for some users. Check the
pam_succeed_if(8) manpage for in-depth explanation of the syntax. An example would be:
auth [success=1 default=ignore] pam_succeed_if.so gid eq 2000
auth required pam_tally2.so deny=5 onerr=fail unlock_time=1200
That means, if the
pam_succeed_if test returns successfully, i.e., for all users in the group whose GID is 2000, skip the following test (
pam_tally2); if the test returns failure, ignore it and continue.
pam_succeed_if tests can be stacked up for fine-grained control.