--extra-vars will work too though I was thinking that group_vars/tag_Group_<name> will override what is in group_vars/all

For example the Group tag on my test EC2 instances is  `another_multi` so `group_vars/tag_Group_anothermulti` has:

```
---
# this path is relative to the playbook dir
secure_dir: '../../configuration-secure/ansible'
```

Which is the relative path to my secure repo.