I suppose you have somewhat truncated understanding.
In term of firewall, there is no need to configure any rule "from internet to Zentyal" or "from internet to internal" (well, if I remember well, this one disappeared from Zentyal GUI
). Rules "from internal to Zentyal" are useless too here.
From outlook, you are opening 2 different kind of session (and protocol).
Now that you explain that you are using POP3 (thanks to the error message you at least provided), and as explained by Robb, you need to allow, "from internal to internet" ports 995 & 587. That's it... in order to achieve this, as service already exist, ensure that "mail submission" service is defined to use port 587 and POP3 service is defined to use port 995 then ensure that you have these 2 services "from internal to internet".
Be also sure that you can resolve you hotmail server name from your client.
Once all of this works fine, next step would be to implement, perhaps, Zentyal mail stuff so that you can benefit from POP3 proxy service with, e.g. anti-virus.