not sure I do understand your design, but ..
FSSO is passive pre-authentication based on source IP (optionally source IP and port range from Terminal Server with TSAgent), and knowledge gathered from already made login to MSFT Domain (anyhow).
So once user, or workstation on behalf of user, does some authorized action on MSFT domain, then this MSFT logon is spotted by FSSO components (DCAgent, Collector Agent). Processed. And completed info (username, source IP (port-range), user's group membership) is then pushed to connected FortiGate units (according to Group Filters, which are either set from FortiGate and pushed to Collector Agent, or set directly on Collector Agent and info is pulled to FortiGate(s)).
Therefore any attempt to connect somewhere, which is passing through firewall policy which does have FSSO based user group as requirement for authorized sources, will fail IF there is no user record in FSSO user list before such attempt.
"I am thinking of the laptop that opens the session before being connected to the company network?"
This is not going to work with FSSO.
You have to have either portal/auth set on interface where users are coming from, but that will apply to all of them. Or have portal active authentication driven from firewall policy with some active method like RADIUS, LDAP, or even on FortiGate locally defined users (not preferred).
Tom xSilver, planet Earth, over and out!