Fortigate active authentication to IP on internet

[tr00g33]

Hello i would like to achieve active authentication just for few IPs on internet, i know i can achieve this for website with webfilter, but i want to block all services to that IP until active authentication.

I would like to achieve following scenario:

10 Users all have access to internet without any special restriction, but only to few IP address`es on internet they have to authenticate for any service on that IP. How to somehow enable active authnetication to that IP, so when the users go to http://xxx.xxx.xxx.xxx:80, they get Fortigate authentication portal, when they authenticate successfully they have access to all services on that public IP.

I created the policy on the picture, it does block the traffic, but how to do the active authentication toward (example: 151.101.193.67)? 

The object internet have IP (0.0.0.0/0).

 Please help me solve this one.