Hello @Icebun ,
As per my research, when a FortiClient endpoint is connected to FortiGate/EMS, the Web Security tab becomes the Web Filter tab in the FortiClient console.
For FortiClient in standalone mode, you can enable, disable, and configure web security by using the FortiClient console. You can define what sites are allowed, blocked, or monitored, and you can view violations.
For FortiClient in managed mode, an administrator enables, disables, and configures Web Filter by using a FortiClient profile.
I do not think you would be required to set up Fortiguard. This should be the part of the license with Cloud EMS.