Require FortiToken to access specific subnet

Hello all,

Can someone help us with this question: We have a customer with an FortiClient EMS license for a few 100 users. The main reason for having the EMS is the Always-On VPN functionality to the FortiGate they have.

Now we want to secure them with FortiToken Authenticator.

The question is, is it possible to have the Always-On VPN tunnel to a specific subnet and then after authenticating with the FortiToken that they have access to extra subnets? Or is it possible to allow specific websites only after being authenticated with the 2FA?

Kind regards