Block internet access with web filter

Hi everyone!

I'm facing a specific need and would appreciate some help to understand the best way to configure this in FortiGate.

I need to completely block internet access for a specific IP range, and then allow access only to certain websites as needed.

Currently, I'm handling this using a Web Filter with the URL Filter option. Within the URL Filter, I have a rule that blocks all access, and above it, I add the URLs that need to be allowed. This Web Filter profile is applied to a firewall policy for the range.

This setup is working fine to allow access to sites for the entire range, but now I need to allow a specific site for only one IP, without affecting the rest of the IPs in the range, which must remain blocked.

My question is: what’s the best way to implement this kind of per-IP exception using Web Filter, without affecting the general rule that is already working for the rest of the range?

Thanks in advance for any help!