A network function (NF) entity in a communication network receives User Plane Function (UPF) registration information for a plurality of UPFs, the registration information including a respective network attribute for each UPF. The NF entity associates each UPF with a corresponding network based on the respective network attribute, and map one or more User Equipment (UE) to the corresponding network based on a security policy to create a UE-to-network table. The NF further receives a request to establish a session for a subsequent UE, the request including a subsequent UE identifier, and determine an access permission for the subsequent UE to access the corresponding network based on the subsequent UE identifier and the UE-to-network table. The NF selects one UPF from the plurality of UPF to service the session for the subsequent UE based on the access permission, and an association between the one UPF and the corresponding network.