Help: Auto-VoIP setting to correct VLAN, but also incorrectly on default

We are trying to configure our S3300's to utilize Auto-VoIP.  The goal being that all devices with the correct MAC prefix will be pushed onto the VoIP VLAN regardless of device settings, and without having to manually adjust VLAN assignments on our switches.

We have the default VLAN for normal network traffic (PCs, printers, etc), and have Auto-VoIP set up on VLAN 88.  We've added several MAC prefixes for our phones.

We have our FortiGate firewall configured with two LAN segments.  The first for PCs, and the second for VoIP.  Both of them are set to the default VLAN ID.

The FortiGate subnet used for VoIP has its MAC address set to match a Poly prefix.

When it is plugged into a Netgear S3300 switch, it shows up on both VLAN 88 and VLAN 1.  It should only be on VLAN 88.  Since the Fortigate is configured to do DHCP duty on the VoIP LANs, this is a problem:  a non-VoIP device will pull an IP address from the VoIP LAN.

The MAC address 80:5E:C0:09:00:05 should only be on VLAN 88.  Since it's also showing up on VLAN 1, when I plug a laptop into the switch, it will pull DHCP for the VoIP network.  That needs to not happen.

Any idea what we're doing wrong?  Any help greatly appreciated!