helping with the network

I think you’re saying separating local-in/local-out management interface from user interface. But there are two directions for those traffic; internet side and internal admin access side. The internal admin access side is relatively simple by setting up “dedicated-to management” interface described in the KB.
 

But for the internet side, like downloading firmware to upgrade it automatically, FortiGuard access and getting IPS/AV database updates, DNS, NTP and so on, first, you need to have a second internet circuit. Then you can either specify each service to use that circuit or use SD-WAN rule to steer it.
Either way, you need to have a default route to both circuits.
 

Toshi

Hi ​@bahaa33 

To properly isolate two physical ports on a FortiGate — one for internal user traffic (e.g., port2) and one for management, updates, and FortiGuard communications (e.g., port1) — configure each port in a separate VDOM or use policy-based isolation with static routes.
First, assign each port a distinct IP subnet and disable any overlapping administrative access (e.g., set allowaccess on the management port to ping https ssh and on the internal port to none or only ping). 
Then, create firewall policies that explicitly deny any traffic between the two ports unless required (e.g., config firewall policy, edit 1, set srcintf "port2", set dstintf "port1", set action deny). 
For outbound internet access from the internal port, configure a default route via the WAN interface (not the management port), and for FortiGate services (updates, FortiGuard, DNS), use a separate static route pointing to the management port's gateway.
To prevent data leakage, ensure no inter-VDOM link or policy allows traffic from the internal VDOM to the management VDOM, and verify with diagnose debug flow and packet captures (diagnose sniffer packet any 'host <mgmt-server-ip>' 4).