Please don't confuse 'Inbound' with 'reply' traffic. Anything referring to 'Inbound' is referring to connections established from outside your network, connecting in to a server you are hosting, for example you might be hosting a web server that people are connecting in to. In this case you'd need a publicly trusted server certificate.
'Outbound' is any connection opened from within your network out to the internet, and covers all the packets related to that connection. So a user downloading a file from the internet is an 'outbound' connection, because the user established the connection to the web server. This connection and the download of the file would be covered by the Outbound HTTPS Inspection configuration, and the CA certificate used for this. Only the user on your network needs to trust this CA cert, the external server is not doing any validation of the CA cert as it does not see it at all. It simply presents its server cert (ideally provided by a publicly trusted CA) to the world and it's up to the user PC to trust that cert.
