configure the Port 16 in Fortigate

The interface configuration has little to no bearing on what users who come through port16 can access.  That has everything to do with your policies and/or zones.

Remember there is an implicit deny all at the bottom of all your policies, so if the only policies for traffic from port16 are to the Internet (none to DMZ, or any other ports), then it won't be able to access anything else. 

If it is in a zone, you'll have to check whether the zone is configured to allow intrazone access, but if not then you simply need to avoid allowing traffic from that subnet to any other subnet within the zone as well.