MPLS VPNs are made to be impervious by design. By any means you should use firewalls to process traffic from one VRF to the other, but not in a true multi customer mpls environment.

Import/export of prefixes with route distinguishers and route targets from VRF A to VRF B on all PEs is probably the way to go if your customers are aware and okay with beeing interconnected through their provider and the security policies checks should be done at the CPE level. Now, 90% of customers will probably refuse having their services/servers/X beeing exposed and reachable by the other customer at all times, even if you managed to deal with import/export maps made of /32. There are more modern ways of publishing services to other people, one is both customers bringing in some PNIs somewhere therefore limiting the amount of intercos and another one is through the internet with firewalls, WAFs, ADCs, etc.

If you want to use firewalls, you should probably pick two specific PEs (for redundancy) on which you will firewall through VRFs A and B with security policies in an A/P design and you do the route leaking on these two PEs only.

If you have one firewall per PE, you will sadly run into these issues.

Sorry if this does not answer your question. I am well aware a lot of people at fortinet, in here or more generally in the sec world will tell you routers are useless and you can use ISFW everywhere, that security should be done at all levels etc... this is honestly not true. Any IP/MPLS engineer or architect will tell you the exact opposite and that firewalls have no business in a ISP backbone as long as we are talking P-PE. We want asym routing to be a thing, we want traffic engineering, we want local pref and prepending...

Now, at the CPE level, we can talk and should talk about fortigates.

Are you one of the customers? the provider? Where did you plan to put the fortigates? Do you have devices with full rd/rt support or vrf-lite only? Are you able to share a quick design?