Geo-Lock VPN traffic

Local-In Policy would work for you. Its only copnfigured in the CLI. You would first create address objects for the countries you want to allow, setting the type to "Geography" and then the country to want to allow. Then in the CLI you would create a policy to allow that country and then create a deny all. 

config firewall address 
edit "US"

 set type geography

 set country "US"

 next
end

config firewall local-in-policy

 edit 1

 set intf "port2"

 set srcaddr "US"

 set dstaddr "all"

 set action accept

 set service "HTTPS"

 set schedule "always"

 next

 edit 2

 set intf "port2"

 set srcaddr "all"

 set dstaddr "all"

 set service "HTTPS"

 set schedule "always"

 next

end

Here is a link to a kb on how to configure it further. http://kb.fortinet.com/kb/documentLink.do?externalID=FD33649