FortiClient proactively defends against advanced attacks. Its tight integration with the Security Fabric enables policy-based automation to contain threats and control outbreaks. FortiClient is compatible with Fabric-Ready partners to further strengthen enterprises’ security posture.
Article Id 190121
This article describes how to configure secure remote access in EMS which is essential to prohibit or allow access to IPSec or SSL VPN connection through zero trust tag
It is possible to configure to block access to IPSec or SSL VPN connection through zero trust tag. 
In this example, it is set to block endpoints with 'Critical' vulnerability:

1) Create a new zero trust tagging rule as below:

2) Access to Endpoint Profiles -> Manage Profiles -> Edit endpoint profile -> VPN tab -> Enable Secure Remote Access:

3) Next under VPN tunnels -> Select VPN tunnel -> Edit VPN tunnel -> Advanced Settings:

In Zero Trust Tag section, select Prohibit and choose 'Critical' tag which has been created and select on 'Save Tunnel' to save configuration.

Devices tagged with 'Critical' zero trust tag cannot connect to the VPN tunnel and will be prompt with customize host check fail warning message.