How to match a specific application only without allowing or denying other applications?

I am trying to figure out a way to allow "msrpc" application to a server using application control.  It looks like in order for it to work I need to create a policy to allow any service and apply an application control profile. Because service is set to allow any I guess I will have to block all applications in application control profile and only add an exception to allow "msrpc".  For this reason this rule has to be put at a place close to the bottom of the policy list so it won't block services or applications I want to allow.  This seems to be working but it just does not seem to be ideal.  In Palo Alto firewall I can just set up a rule to match the specific application only so other type of traffic will not match this rule, therefore neither be allowed or denied.  I am wondering what is the best practice in Fortigate in this scenario?