Allow only certain sites and if do not match next policy
I need all (all internal ip addresses: servers and workstations) open only certain sites for example apple.com, google.com over the HTTP and HTTPS protocol.
I also need all users (with authentication) who work on workstations to open access to the Internet, with the exception of for example audio/video (for example, Youtube).
I created a firewall policy with SSL Deep (ID1) inspection that allows access to all (without authentication) from the inside to the sites apple.com, google.com, using WEB filter, where I disabled the FortiGuard category based filter and added apple.com, google.com in Static URL Filter to ALLOW.
The following firewall policy with SSL Deep inspection (ID2) below allows internet access except for audio/video using application control also.
as a result, I have all the traffic going through the policy(ID1) where all sites are opened, even audio/video (for example, Youtube).
I understand that in Static URL Filter Allow is the default action and everything that is not specified in it is allowed.
How do I make sure that what is not specified in the Static URL Filter is not taken into account?
Or how do I implement my task?