Only allow one application

We normally don't use application control, but fixed ports, more or less just allow http/https for the employee networks.

I have now received a request whether we can allow Whatsapp. We don't have a general policy about not using it, it's just not very clear on how to enable it specifically.

So, my general question, is possible to add a new policy that only allows Whatsapp, that would work together with the rest of the policies?

The device is a FortiGate 60D.