Forticlient VPN device ACL ?

Hello, we use Forticlient VPN to our Fortigate.

What is our best option for filtering SSL VPN access via Forticlient by device type

e.g. to only allow VPN access to certain subnets from iPads and to differenet subnets for Windows devices etc ?

is it possible to do this on the Forticlient end points or do we have to do this on the Fortigate ?

Thank you.