FortiNAC Device Limitation

Currently for contractor user the fortinac will use captive portal using entra ID before gain access to the network.

If I only use SSO for the authentication then same contractor user can use any workstation to access the network. Some one here know can we limit the device for single user, example using mac address restriction?
I try register manually the devices and assign the device to group named 'Contractor' then if this device plugged to the switch then fortinac open the capive portal and showing the device was registered, the captive portal not bring to login page.