FortiProxy Explicit Proxy Deployment | Recommended Authentication Method

It depends:

Kerberos will be the most accurate method but also a bit tricky to troubleshoot if there are problems. Also it can be a bit load intensive.

FSSO will be less accurate by time; generally no issues, but end users IP changes will have a slight delay of a minute, give or take. It will however generate less load on FortiProxy and towards the LDAP server. NTLM shouldn't be considered anymore.