Active Directory / DNS /Portal Captive

Hello and thanks in advance for reading this post.

I have a fortigate that I plan to connect with AD for staff authentication. Also, I would like to provide internet to visitor and for that I want to give access to a Portal Captive. Is it possible to do this...? The staff authentication should be transparent when they login to the domain. The visitors should not be joined to the domain, instead I would like them to authenticate via de portal captive, make sense?

Thanks for your support,

Carlos