Fortigate user traffic quota

Since policy routes are evaluated top-down, you can work around this limit by placing a more specific entry matching traffic from internal subnet A to internal subnet B.

However, this should be less than comfortable if you have many different networks attached to your internal interface.

In this case, I would recommend you a trick I once used: since Fortigate devices ignore QoS marks, you should sign your "internet" packets on the firewall-facing port of your Cisco switch with a specific TOS and then use that mark in your policy-route.

The Fortigate has the most advanced SIP protection of any firewall I have seen. It does remove the need for an SBC if your concerns are solely security.

What a Fortigate will not do, which an SBC does, is to transcode the voice codecs, but this is probably not needed in your environment.

There are two SIP ALGs in the FortiGate, one is a basic session helper and is on by default. This takes care of any NAT problems but does not address security. The second is to apply a VoiP profile to your SIP traffic. With this VoiP profile you have a huge amount of granularity on what you can do in the way of protection, but this granularity is only visible and settable via CLI.