Firewall -> source and dnat

I have two vdoms that are connected by inter vdom link.  To simplify the description, vdom 1 is 10.0.0.0/8 and vdom 2 is 192.168.0.0/21.  We have a static route defined on each to route properly, and each is the default originator for their network.  There are a number of firewall rules defined on each of these vdoms to only allow specific traffic from the other into themselves.  In essence, they both allow all traffic outbound to the other but filters the inbound.

The organization with vdom 1 has now added subnets in 192.168.0.0/21 to their network, so we have to now NAT the traffic from vdom 2.  I am having trouble figuring out the best way to do this with the fortigate while still retaining the protections in place by the firewall.  Initially I thought that a VIP that simply would map something like 10.192.0.0/21 to 192.168.0.0/21 would work, but I believe that I lose all of my other firewall protections if I used a pool of that size.  Likewise, I cannot configure that large VIP pool as a last rule and then other VIPs that are a subset, as I have a duplicate address defined.  This is a problem in the instance that I would like to allow all ICMP traffic but then limit host 1 to RDP and host 2 SSH for example.

Any pointers would be greatly appreciated.