Override user group permission for specific Application (team viewer)

[globix]

Hi,

We are using FSSO with DC agent to get identities of users logged on the domain.

The users belong to a group, and we assign them some rules (web Filter, App ctrl etc..)

By default users are not allowed to acces teamviewer. Team Viewer application is blocked by Application control.

OK, perfect...

When needed we would like the user can bypass their original group to access another group which would allow teamviewer.

If possible is it also possible to limit by time how long the user can access the application?

Would it be possible? 

I think the Fortigate gets identites and it is not possible for the user to get some new rights....

Any help would be appreciated

Thanks