Rds web page authentication and mobile App

Question

Hi all.
I have a rds farm. There are two web access server/gateway in dmz in microsoft nlb. Inside i have two host access and two connecttion broker in hight availability with record dns in round robin. Every thing work fine. Hight availability work fine for all role. I have a problem with permission to access on web page form. I configured my collection with a security group. If you are not in those group you can't open any application but i don't know why i can do login in webpage. And worse, if i use remote desktop app on my smartphone and configure rds gateway whit credential that are not in security group i can do login and i can connect on pc in my inside network. In this case i don't use gateway server as proxy but i can connect directly. How can i disable login on web page for some users and how can disable direct connection when i use mobile app?
Thanks.