Exception is not working when I specified user or group

You cannot have two profiles using the same network and filter mode.   The first one to match will be the only one used.   So one or the other of these will never be used.

Standard Mode profiles apply only to devices that have proxy settings configured.   Transparent Mode profiles capture both standard and transparent traffic (undocumented feature).   So if you are using both Standard and Transparent mode profiles, you want the Standard Mode profiles to appear first.   I recommend using Standard Mode with authentication and Transparent Mode without authentication.

You do not show a Transparent Mode filter, so any device that does not have the proxy configuration will bypass all authentication.   So you need to investigate whether the device has the Standard Mode settings configured.

Good point, I disabled the Profile1 and keep just default, Standard Mode with AD SSO authentifiacation. 

Web filtering is the best part of UTM, but the documentation does not explain concepts adequately.  I wrote up my version of a concepts document and some others which have made it into Recommended Reads.

https://community.sophos.com/utm-firewall/f/recommended-reads/115522/sophos-utm-securing-and-configuring-web-filtering

Hopefully this will help.

Web filtering is the best part of UTM, but the documentation does not explain concepts adequately.  I wrote up my version of a concepts document and some others which have made it into Recommended Reads.

https://community.sophos.com/utm-firewall/f/recommended-reads/115522/sophos-utm-securing-and-configuring-web-filtering

Hopefully this will help.

You wrote i really nice, but I think I configure it propertly. But it is really weird that I have to skip authentification to get it working propertly. Cause I want it to more specified, I dont want everyone to access the page.

You need two policies on the one profile.

The profile should request but not require authentication

The first policy is for designated users and groups, such as yourself.  The second policy is tagged for use by unauthenticated users. Then configure filter actions for each policy.

Let me show you, so we have Web Filtering in Standard Mode with AD SSO authentification. 

For this profile we have 2 policies: 

My profile Skryja is in InternetFree and for this group I want to access reddit and spotify. I this this is configured corectly. Or can you explain it more to me please?