Which IP Address is used for outgoing Gateway connection and how to change the outgoing IP

Do you have a Route Based IPsec or Policy Based? 
We are using the interface used. For RB IPsec, we can use the XFRM Interface. 
For Policy Based, you need this rule: https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/SiteToSiteVPN/HowToArticles/S2sVPNIPsecCreateIPsecRouteNAT/index.html 

Do you have a Route Based IPsec or Policy Based? 
We are using the interface used. For RB IPsec, we can use the XFRM Interface. 
For Policy Based, you need this rule: https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/SiteToSiteVPN/HowToArticles/S2sVPNIPsecCreateIPsecRouteNAT/index.html 

It is an Policy Based VPN connection.

I will only NAT the ZTNA Traffic and not all of the Traffic from internal. I have no option to only select ZTNA as Source IP, haven't I?

There is no Object ZTNA which I can use as Source IP Address in the NAT Rule.

As this is an internal service of the firewall itself, there is no ZTNA object. 

Ok thanks. Is there another way to NAT it only for ZTNA Ressources?

No, but is this a problem? You can deny traffic there via Firewall rules.