(sorry about the late reply)
With WSSO, the matched string sent from NPS is compared to the name of the group in your FortiGate (what you have in "RADIUS_WiFi_???"), and the group must be completely empty in the config. (no reference to any RADIUS server)
WSSO does not use the "Remote server" + "group name" options.
WSSO group matching logic
[ corrections always welcome ]