Network: Any should also work, because only traffic that is send out this interfaces is masqueraded. For the public IPs from ISP1 this is what you want, but for all other traffic (if there is any) this can also do no harm. Your rule is more specific.
