o.k. I see that is basically the default.
However in this case, if the wifi users get IPs from 192.168.68.0/24, then this WiFi-AP must do the NAT and translate the traffic to 192.168.1.x, and this ingresses port1 on FortiGate, correct?
If this is so, then you should not need to configure anything on the FortiGate, as this traffic is handled only by FortiGate's internal switch.
I understand you mentioned that the communication doesn't work, but from the FortiGate perspective there is no configuration that would allow or block this kind of traffic.
You mentioned that you would remove one interface (possibly internal1) from the internal switch and have the WiFi clients connected there.
This would be my preferred approach, however still in the WiFi AP should be just AP (just bridging the traffic and not routing).
With this setup, you can actually filter/monitor traffic from WiFi to NAS.