Can Azure SSL VPN cater for multiple Entra ID Groups?

The goal is to cater for two types of user accounts which require VPN access; internal staff accounts added to a dynamic group and member accounts used by third-party users which are manually assigned to a group as required. 

My question is whether it is possible to set multiple Object Ids in the below config on the FortiGate corresponding to multiple Groups assigned to the FortiGate Enterprise App in Entra.

Any alternative suggestions for how this scenario can be handled are welcome.