The user opens the outlook prompt certificate alarm

I cannot speak mandarin or whatever this language is :) But what i can tell is that you computer does not trust the Certificate Authorite Sophos SSL_CA.
You need to import that certificate to the computer ca trust store.

You can export the certificate in the Sophos Webinterface.

Another way would be to exclude partner.outlook.cn from our tls and webfilter.

I tried exclude partner.outlook.cn from our tls and webfilter, but to no avail.

Without any details on your enviroment and config on the endpoint as on the exchange config, i am not sure if we can help.
I think you should get in touch with a sophos partner and he should get this to work in no time.

Does you exchange connection work work withouth the xg inbetween?