Just use the regular hooks you would use on your site only put a condition around them:
PHP Code:
if (VB_API === true)
{
code
}
(although this is going to be tricky. The user needs to actually login in order for you to know what usergroup they are in. So, you will have to think about what your action is going to be for the user after they login in since you can't actually stop them from logging in.)