Is is possible to separate domain users from guests?

[caos]

I'd like to give all non-domain users in a specific VLAN Internet only access, while domain users (or domain-joined PC's) can access internal resources as well. My plan is to apply this VLAN to meeting rooms and other areas where guests can be expected to connect their PC's.

I've followed this instruction: https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/731999/fsso-in-polling-mode-for-windows-...

Well, it doesn't work. Everything looks OK in the FW, but I get internet only access when I connect my PC. 

Never mind my current config, my question is: Is it even possible to implement my scenario? The users may or may not have signed in to the domain before plugging in their laptop in the meeting room. The PC is domain-joined, the user is a domain user, but may be logged in with cached credentials. 

[brycemd]

It sounds like you are looking for 802.1x or perhaps a NAC solution.

But, you can accomplish this with RADIUS and configuring the switch(or Access Point) for 802.1x auth and it will put the device on a specific vlan based on the RADIUS response. Doesn't have a lot to do with the FortiGate unless you have fortiswitches or using FotiNAC though.