Create firewall rule to block TLS1.0

I would assume, this can only be archived on a Stream based. Sophos XG V18 can do such a blocking. 

UTM can only prevent to communicate with UTM TLS1.0. So you cannot talk to the Proxy with TLS1.0.

But it cannot prevent the user to open a Port to a server with TLS1.0. 

You are saying UTM does not have this capability but XG does?

Maybe the IPS could do this kind of blocking, but i am not aware of any pattern in UTM to do so. 

For such context blocking, you would need to have a architecture in real time, to analyse the used cipher in each connection. 

You think this is more Layer 7 application filtering?

There is the Handshake. https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_handshake

The client tries to open a connection (TCP Handshake). After the TCP, the TLS Handshake follows. 

In one of the packets, there is the "wanted version". (ServerHello).

UTM can disable the TLS1.0 version everywhere. Hence the Client cannot communicate to UTM with TLS1.0. 

The issue will come up, if you have Clients communicating to each other or to the Internet "through" UTM. It cannot prevent the TLS1.0 version in Transit, like requested. 

Maybe it is enough for your SoC, to have TLS1.0 disabled for everything on UTM. But if you need to prevent TLS1.0 everywhere, you would need XG Firewall with V18. 

Overall you should get in touch with your Sophos Partner to discuss this further.