question about passwordless logins and VPN

Hi all,

A stated in subject, my question is about passwordless logins. So we are trying to implement yubikey with PIN + Touch as a primary authentication. Then Fortiauthenticator agent for windows with PIN + Token as a secondary/fallback authentication in case user forgets his yubikey. This two already work without any issues. Now comes the 3rd part :) On top of this we want to implement Always ON VPN with Forticlient and EMS. User should have zero interaction with forticlient. 

My question here is if this is even possible to do?

Thank you for your help