Agent and Agentless

Agentless is HTTP/S only. 

Agentbased is every Port.

So if you want to publish something for HTTPS, use Agentless, will work both, for an Agentbased client, and a mobile client. 

Ok but if I want to access an external resource, like SaaS (Salesforce etc.). The external fqdn in the resource settings require our ztna domain prefix...?

So essentially you need an Agent to run this, because ZTNA is not a Proxy.

I talked about this in lenght here: https://www.reddit.com/r/sophos/comments/126zv61/sophos_ztna_with_cloud_apps_eg_itglue/ 

Essentially, as you are not the owner of Salesforce.com for example, you cannot redirect any client to your solution. And you cannot simply say "customer.com --> SFDC" as SFDC will smash your redirect because of the lack of rewriting of those requests.

This kind of technology is not implemented in ZTNA and is more likely a SWG /CASB technology than a ZTNA technology. 

How about a scenario when I am trying to access a private resource in Azure which as our domain prefix but an external ip?