Since you route your VLANs on the SG300, the Fortigate can't ever see the client's MAC address. All it can see is the SG300's MAC address on VLAN 1 (which you've probably permitted so everyone gets through). MAC addresses are only meaningful within their layer 2 segment/VLAN, they simply cease to exist outside.
(When a MAC frame is passed to a router, the router strips the IP packet from the frame and when forwarding it encapsulates the packet in a new frame with its own MAC as source.)
I wouldn't use MAC-based authentication. Using reserved DHCP addresses on the DHCP server maps the MAC addresses to specific 'static' IP addresses. These you can use on the Fortigate. To prevent a client to use a fake IP address you can use DHCP snooping and MAC binding in the SG300 (not sure if the SG300 supports this though).
If you do need to do this based on clients' MAC addresses you'll need to extend the VLANs up to the Fortigate. This however produces the problem that the LAN clients would need to use the Fortigate as default gateway towards the Internet but the SG300 as gateway for the LAN subnets. Routing everything through the Fortigate would work but is probably not what you want.
If you can't set up a static route for 192.168.0.0/16 on the clients pretty much your only bet is to rely on ICMP redirects (causing each Internet connection's first packet to be lost).
Another option would be to use the Fortigate's single sign-on feature and have the client authenticate towards a Windows AD or such.
Yet another option is to apply MAC-based filtering on the L3 switch but that's not a good design - you'd be splitting forwarding decisions between core switch and firewall.