Block incoming TeamViewer connetions, but allow outgoing

My understanding of Teamviewer is the session is always initiated from the client side. That's why they say " ...in 70% of the cases a direct connection via UDP or TCP is established (even
behind standard gateways, NATs and firewalls). The rest of the connections are routed through our highly
redundant router network via TCP or http-tunnelling. You do not have to open any ports in order to work
with TeamViewer!"

https://dl.teamviewer.com/docs/en/TeamViewer_SecurityStatement_en.pdf

Probably this link has more info including the TCP/UDP port numbers they use.

https://www.teamviewer.com/en-us/trust-center/security/

The problem with TeamViewer (and similar software) is that the client side will initiate a connection to the server and maintain it. If someone wants to connect to that specific TeamViewer, they will ALSO connect to the server, and the server basically joins up the sessions. There is no session initiated from the outside towards TeamViewer (there can't be, that would require the TeamViewer to have a public IP it can be reached on, OR a VIP on the FortiGate to pass the traffic through).
The pre-existing session (from inside to TeamViewer server) is simply taken over for screensharing.