IPSEC Dial Up VPN and Firewall Policy Rule

you should be able to choose the group that is used for ipsec or sslvpn where the interface for ipsec or sslvpn is used.

if it's used as a source interface, then as a source and viceversa.

Sorry but in the case of a destination, i cant (i can only choose from address and service, no "user") even if the interface is the correct one.

No, you cannot, neither in 7.6.3 nor in any FortOS version, and never could. Which means you are trying to achieve some goal in a wrong way, why would you need User Group as the destination? Tell us the final result you are trying to achieve. 

Hi team,
only in the source you can choose user group
-Naveen 

Yes, I remembered that if I change something on the Tunnel side on FG, I should also change it in the same way on FortiClient. What surprised me the most was when I changed from IKEv1 Aggressive to IKEv2 there were no logs on the FortiGate side. It was as if there was no connection between my computer and FortiGate at all.

Well the whole idea is to have one tunnel for a group that has sub groups, i.e one tunnel for all sub groups, and then choose in firewall policy rules to allow whatever you want using either source or destination. It seems from your answers you can't select a group in a destination. What it does, is in this case, you will end up allowing traffic to go to all the subnet (i.e all groups) when you would want it to go only to some specific group.

It seems like the only solution from what you all said is multilple tunnels.