SSL Web Portal and Tunnel Access for the same AD user and 2 Faktor Authentication

Hello, i have a design question for SSL VPN and 2 Faktor authentication. is that true that an Active Directory user cannot be used at the same time with an SSL web portal with Fortitoken authentication and with an SSL VPN Tunnel portal with certificate-based authentication on the FortiClient ? If we want to be able to authenticate via Web Portal and Fortitoken and additionaly have the possibility to authenticate via FortiClient and Certificate inspection with PKI, we would have to work with two different AD accounts for the same person. Is that correct? Thank you