URL belongs to a denied category in policy

We have a Web Filter Security Profile where the FortiGuard category based filter is enabled and set to Block for the "File Sharing and Storage" category. We want to restrict which "File Sharing" sites our users can access. So we created Static URL Filters with the action set to Allow. For Example: *.dropbox.com *.dropboxstatic.com. The problem is that the traffic still gets blocked with the message "URL belongs to a denied category in policy". The only way we've been able to get this to work, is to set the action for the static filter to Exempt. I found an old KB article that states this is because static filters are processed first, followed by FortiGuard web filtering. The issue we have with using Exempt is that it excludes all other scanning, DLP, antivirus, etc.  How is everyone else handling scenarios like this?