global config to force phone to use private subnet in shared-network enviroment?

[Sue True]

Greetings,

I've been trying to get this work with no luck, so I'll ask the list to 
see if it's possible.

In our config, we usually have two subnets in a shared-network, one is 
private(10.10.x.x) used for phones, the other is public, right now we have 
class defined for phone, and config 'allow/deny member' to each 
private/public subnet so phones pickup address from 10.10 network only.

Since we have hundreds of networks and I wonder if there is a way achieve 
the above using global option, I've tried

if binary-to-ascii(10,8,".",substring(leased-address,0,2)) = "10.10" {
     allow members of "i2004-clients";
}else{
     deny members of "i2004-clients";
}

But got error:
/etc/dhcpd/dhcpd.conf line 147: expecting allow/deny key
     deny members



Thanks in advance..
Sue