Best Practices...

I'm a long time Palo Alto user and just transferred to a new organization and we utilize the FortiGate 401F. We utilize GeoBlocking for both incoming and outgoing however it is implemented using an Access Control List.  I've seen posts using a Firewall Policy to implement Geo Blocking. Obviously F/W policies give an in-depth look using security policies but would like to hear from the community what is a best practice for Geo Blocking, ACL or F/W policy?  

Also is there an online document on recommended best practices for the FortiGate?

Much thanks!