2 questions with MTA mode email protection

In the following document, Sophos said that Protected domain field can be inbound or outbound domain.

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Email/PoliciesExceptions/EmailSMTPRouteAndScanPolicyAdd/index.html

But inbound and outbound routing are different totally.

Inbound will route the mail to internal mail server with static host,

and outbound will route the mail to internet mail server with MX records.

Why can this protected domain field be inbound and outboud domain at the same time? 

Under the premise of one domain one policy,

how should I create the correct SMTP route & scan policy for both inbound & outbound direction?

There is a KB for Multi WAN: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/122602/sophos-xg-how-to-setup-mta-mode-when-you-have-multiple-wan-ports-or-alias-ip-addresses

But it only works for the entire MTA, not Domain specific. 

Thanks, that's why I open the question.

It is not supported. The MTA cannot do this. Simply because the MTA forwards the Port 25 Connection. The Firewall does not know, which domain is currently sending a Email.

for inbound email working fine but when our mail server try to sending email always show error dsn=5.6.4 status=bounced (mail for domain target loops back to myself)

how to solve this?

Have you enable relay host for your mail server?