Compliance check for AD machine

Hi, 

We are in the middle of POC for forticlient EMS server. 

The main objective is to allow compliance check to only allow corporate AD registered laptops to allow remote VPN to Corporate resources. 

I understand that the compliance section is configured in the FW, so i checked fortimanager under Forticlient Manager -> Forticlient Profiles , but  i dont see any option to check for AD registration. 

How can we (using forticlient / fortimanager / fortigate FW) prevent "malicious" users, from downloading the new forticlient and install it on an un-corporate machine? 

Thanks.