Use local users for less restrictions

Hello team!!!

I have a local group "UsersLevel1" in the FGT with many members

I have 2 different web filter and application control, for level 1 (less restrictions) and level 2 (More restrictions) 

What I am trying to accomplish is the following:

- When a user try to access Internet, FGT ask him username and password

- If user enters valid credentials in the "UsersLevel1" Group, he can navigate with level 1 security profiles

- If user does not enter any credential, he can navigate with level 2 security profiles

If this is not possible, we would like to do the following:

- When a user try to access Internet, FGT ask him username and password

- If user enters credentials in the "UsersLevel1" Group, he can navigate with level 1 security profiles

- If user enters credentials in the "UsersLevel2" Group, he can navigate with level 2 security profiles

Is this possible?

When I enable "Security mode: Cautive Portal" on the LAN interface, if I create a rule with local users on it, it seems that you cant just does not enter any credential, FGT will stop looking for matching rules after this rule with local users

Later I will configure FGT to synchronize with AD, but we wanted to do this for devices which can not join AD

Thanks in advance.

Regards,

Damián