Web Filtering - Remote Sites questions

[17g]

Hi All

I purchased a FG-200D which is due to arrive tomorrow (My first Fortinet device). Since speaking with my supplier and having a demo etc, I have a question which I cant find the answer to. Currently we are using a cloud based web filtering application but I want to explore ditching that and using the built in Fortigate 200D Web Filtering. This is straight forward for me to setup for users local to the the site where the 200D is (Head Office). My remote offices will connect to head office via site to site VPNs/Sonicwalls.

Q1 - I want these remote office users to use the 200D to check if the site is allowed/Blocked but then use their own internet connection to browse to the website (if the site is not blocked) and not use the head office bandwidth. Is there anyway to do this? 

Q2 - For users working from home with a company device with just an internet connection (no VPN etc) is there an agent for example that can force them to check the 200D Web filtering and again if allowed, use their own internet connection to browse to the page? Or do they have to have the VPN on?

Q3 - If I purchase Fortigates for my remote sites, Can I manage Webfiltering for all my Fortigate devices centrally? So I don't have to set a specific allow website rule on each device.

I really want to avoid my entire company using the head office bandwidth but instead use the 200D to check if the website is allowed or now. 

Hopefully that makes sense

Thanks!