How do I setup XG to allow email clients to authenticate with Mail server?

Hi all, 

i'll try to keep this short as possible. (i'm also noob to email systems).

what i've done.

1. I've setup hMailServer on windows 2019 in DMZ.  (opened all smtp/ pop / imap ports including ssl ones on server - tested via putty)

2. I've setup MTA as per the Configure email protection in MTA mode (sophos.com) 

3. i've setup a firewall rule to allow those ports inbound to my mail server in DMZ.

I've been sending emails inbound, and i can see via the EMail > Mail Logs that emails are making it to the server. and verify this by seeing the mail box size increase.

When I try to connect to the server via "outlook" it fails every time..  

when I check the "Email > Mail Logs" again, they are being dropped and bounced? i can see the subject "Microsoft outlook test message" which is part of the login process.

i'm guessing its failing because the client isnt getting a response from the test emails.

Just for thoroughness, I've yet to add an SSL to my mail server or XG box (I assume it will be the same one). once I work out where to buy one, that will be done too. (are they just the same as web SSLs?)

Tia

Dave