Consider the following values for a link in my website's homepage:
Is there any priority between above options? I'm asking from the security point of view and also from the SEO point of view.
A common and well-accepted convention for urls is: domain.com/section/sub-section. This is how we organize files and directories. /Media/Music/Johnny-Cash/i-walk-the-line.mp3.
domain.com/posts/justin-beiber-running-for-president/ --> article url
domain.com/authors/john-smith/ --> author's bio and archive url
domain.com/cars/sports-cars/ferrari/488-s --> product url.
So, in your case, I'd suggest /portal/testportal/page/1/fa. If there are only a few portals, you might as well skip the first part, portal.
Here's an article that goes into it: https://www.palantir.net/blog/palantirnets-guide-digital-governance-url-naming-conventions
At the end of the day, if google (and your site visitors) find your content worthy, google will elevate you in search engine results even if your urls don't follow a sound pattern. Exa: https://www.amazon.com/gp/product/B07BJ88DCW : no one can tell what it is that Amazon is selling in this url. But, then again, it's amazon. A brand new e-commerce site will have a tough time making it with haphazard URLs.
Next, security This is something you can only handle it on backend. URLs can only do so much to prevent bad actors from guessing url patterns on the site.
Common platforms like wordpress have their admin urls as /wp-admin. And there are bots that scan the WWW for any loop hole they can find in the system.
In other words, don't rely on url structure for security. Next, you have to consider two things -- authentication and authorization. This may be obvious to you, but I am typing it out for the sake of it.
Authentication is when you make sure username/pwd are correct before letting a user log in. Authorization is what governs who has access to what. Sounds like you are concerned about the authorization part. This is something where you will have to create robust rules in the backend so that the user authorized for portal A doesn't sneak into portal B.