Trunk, how to add an access port

You create a firewall policy to allow access from (srcintf) port3 to (dstintf) vlan50

> how can I make port3 access vlan50?

Not possible with the way you configured this currently.

For incoming packets, untagged frames will be considered as arriving on the logical interface "switch2", and tagged frames will be considered as arriving on the logical interface that has the matching VLAN-ID (so presumably VLAN-ID=50 => interface "vlan50", etc.)

Egress is controlled by routing table, and if the egress interface is a VLAN-interface, the frame gets tagged with the appropriate VLAN-ID when it finally egresses out of the underlying physical interface.

"VLAN switch" could be the feature you're looking for, but be aware that this will require reconfiguration/redesign of the interfaces.

docs: https://docs.fortinet.com/document/fortigate/7.4.5/administration-guide/183531

In this mode you create virtual switches, whose members are "access port" (accept untagged traffic), and then selectively pick individual interfaces to act as trunks (but you can't select specific VLANs to be trunked, it's all or nothing).