Best practices for web application firewall

Hello,

I've been asked to securely serve up access to our internal security camera system via the web so remote users can access it without hopping on our VPN. This security system is enterprise class but I don't trust it to be securely open on the web by itself. I have a Fortigate firewall in between the security cameras and the internet, and am hoping I can leverage the firewall to better protect the security cameras when I put them online.

I've not used the Web Application Firewall service before. Can anyone help me out with best practices for the WAF?

Thanks in advance for your help!