FortiAP w/ FortiNAC as registration portal

I'm looking for configuration example on the FortiAP to solve this use case. 

Client connects to an Open SSID, gets an IP from FortiNAC's registration interface. It is then directed to FortiNAC registration portal. Once the user is authenticated, NAC policy is applied and the Wifi vlan is changed to allow access.

On the "Main" SSID interface, should there be any IP address ?

Should Captive Portal be enabled with the external IP of NAC's registration interface ?

Would you have two SSID "subinterfaces", one for each the registration vlan and guest access vlan ? Or just one for the guest access vlan.

Any example configs or guide on the AP side would be much appreciated. I believe I have what I need on the NAC side.

Don