SSL VPN for iOS with certificate only authentication

Dear Fortinet Community,

we are implementing JAMF right now as our MDM solution.

With this we also want to create a SSL VPN for our mobile devices.

We already use SSL VPN Portals for our notebooks and work there with a certificate and LDAP authentication.

For our mobile devices we want a certificate only authentication but it is not clear for me how the Fortigate should know in which Portal the mobile devices get because normally it works with the user groups from LDAP.

As a VPN Client for the mobile devices we would like to use FortiClient. 

Do you have any best practices for this scenario?

Thanks in advance.

Kind Regards,

Jan