Virtual IP for npm breaks my VPN

I have a FortiGate 60F running firmware v7.4.3 build 2573.

It is connected to the Internet via the Wan1 interface. Wan1 is configured with a static IP address that I rent from my ISP. My firewall is configured to let the internal network go out to the Internet. 

I followed the documentation to add a split tunnel VPN so that I can RDP into my servers. It has worked great for a couple of years. 

Lat week, I added a Virtual IP and a policy to point to my NGINX Proxy Manager. To expose an HTTP site with an NPM cert to make it HTTPS. But when I activate the policy, it breaks the VPN.

Obviously, my knowledge is minimal at best. I would like to be able to expose a couple of web apps through NGINX and be able to continue to use RDP from the outside.

My goal is to learn, and to solve my problem:

1. Should I be looking at using the FortiGate as the reverse proxy? If so, where is the documentation for setting that up and how to have it generate certs the way that NPM does. NPM is super easy, but I am having a time figuring out how to get the FG to do it.

2. Is this a scenario where changing from the split tunnel to SPsec VPN is the way to use the Virtual IP and have VPN access at the same time?

3. Is what I am doing pretty complex and fraught with danger, to the extent that I should continue the classes on Fortinet training and come back to this later?