Will you be implementing this application in multiple regions? The traffic manager routes traffic at the DNS level and has 6 routing methods. The end client will connect directly into the Azure region after hitting the traffic manager and all further traffic will bypass the traffic manager for that session. Depending on your load balancing needs and if you have the application in one region I would recommend the Application Gateway and enabling the Web Application Firewall. This would limit the number of resources and complexity of your networking. This would combine the Traffic Manager, Fortigate Firewall, and the Azure App Gateway.
The routing would look like this.
Internet-->Application Gateway(Web Application Firewall)-->Target Web VM.
This of course is dependent on what other VM's and services you are configuring to site behind the Fortigate. If its just this one VM in a singe region, I would strongly suggest going with the Application gateway instead.