Is there a VPN client out there for the 8700 that can do cisco group authentication?

I don't think so. You might want to google it to see.

This isn't exactly an answer to your question, however if the Blackberry is using a BES that's on the network that you want to VPN into, the Blackberry Browser routes through the BES network, so you should be able to get to Intranet sites without a VPN.