cannot stablished NTLM authentication channel with Domain

Do you have AD SSO (Kerberos/NTLM) enabled? 

Yes, i did.

The question would rather be : You want to use Kerberos/NTLM? It looks like its not configured properly. Hence the question, if you actually need kerberos/Ntlm. 

See https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContent/AuthenticationKerberosTurnOn.html

Yes, we use STAS. Before we updated our Sophos, everything was OK. After the update I get these logs.

STAS is not Kerberos/NTLM. This is a new technology, included in V18. Hence you are seeing this. If you not use this technology, simply disable AD SSO on the Administration - Device Access. STAS will be enabled via Client authentication. You should not experience an issues. 

STAS is not Kerberos/NTLM. This is a new technology, included in V18. Hence you are seeing this. If you not use this technology, simply disable AD SSO on the Administration - Device Access. STAS will be enabled via Client authentication. You should not experience an issues. 

I disabled AD SSO, but I still get these logs.

On all Zones? 

Yes.

Try to edit the AD Server and save it without changes. Then double check, ad SSO is disabled. 
Maybe reboot the firewall and it should stop logging this error.