privacyIDEA and the FreeRADIUS acts correct.
They send back a Access-Challenge.
This is a RADIUS packet that is ment to tell the Fortigate “The user is not completely authenticated, yet”.
If the Fortigate would in turn act correctly, then it should display the Reply-Message: “Please enter your otp:”.
If your Fortigate does not do this, there is something wrong with your Fortigate.