Allowing specific arbitrary devices full network access

[arosenblatt]

I'm in the process of building out a system that will let users register their devices with our internal system for auditing purposes. We'll be tracking them by MAC address and having them enroll each device via external Captive Portal. So, my question is can I whitelist arbitrary sets of devices for network access by MAC address? So far I've only seen interfaces for either whitelisting classes of devices (like Windows PCs on a given network segment) or denying DHCP addresses to devices that are not whitelisted, which would then presumably make them unable to access the portal in order to enroll their device. So, is there a way set up my Fortigate 51E (5.6.2) such that unrecognized devices will be sent to our Captive Portal for registration/enrollment and would then be granted network access as if they were a logged-in user?