Managing users internet access problem (PROFILE BASED)

Hello everyone,

Where i work we have a Fortigate 400E unit and I have some doubts on how to manage internet access for some of the users, we are using the profile based mode:

Heres the scenario:

Sales department have a firewall rule "Sales department internet access"

Marketing department have a firewall rule "Marketing department internet access"

General managers have another firewall rule for them aswell.

Those internet access rules have different levels of access. For instance, general managers can access more websites than sales or marketing departments. 

So far this is working, not issues at all. But sometimes a user from marketing or sales department gets assigned a task that in order to get it done he/she must have access to certain websites that are not allowed in the original policy.

So, i need to give that user (and only that user) the permission to access the new websites he needs to access, but i dont want to give that access to the whole sales or marketing department (this is required by the Cybersecurity analyst aswell).

Do i need to create a new policy that adds the original department permissions plus the new permissions? This seems very inefficient because if thats the case i should create tons of rules of internet access because this happens more often than not.

Additional information: Apart from profile based mode on the firewall, we are using windows active directory sso, so all of the rules are using windows security group membership as one of the requirements.

Thanks in advance!