Portal First

You could use multidomain sso configuration.

Multi domain sso can be selected in apm policy and then configure all fqdns.

Primary should be your portal.

Then apply apm policy to all VSs.

With this config when a user tries to go directly to a  VS will be redirected to portal in order to authenticate. After successful authentication will continue to requested VS.

You may not even need webtop links with this approach. But of course you can leave them for anyone accessing portal itself first.