Oh man, that NAT thing tripped me up too when I was learning. So if I'm reading this right, on Sophos the firewall rule just allowed the traffic and NAT was bundled in? But with Juniper you have to let the NATed IP out in a separate rule? That's a big change.
What did you end up doing for web filtering? I'm looking at a similar move and the built-in proxy is a big thing to lose.
The logging sounds painful. Is it all going to syslog now?
Yes, NAT and policy are separate. It's not just a separate rule, it's a separate table. Your security policy evaluates the post-NAT traffic, not the original.
Web filtering? We ripped it out and went DNS-based. The SRX proxy isn't worth the CPU hit for 100 users.
Logs are syslog, but structured. It's a firehose. You filter it on the collector side, not the firewall. Trying to make the SRX sort it will melt the box.
Prove it.