Dumb ASA 5506 Question

So we mostly rip out ASA's and install Sonicwall / Sophos - but in this case we are installing one to replace an old Watchguard - so out of lack of recent experience I am not up to speed on the latest version of IOS/ASDM. I am trying to use the outside IP address to allow in 443 and 25 to the exchange server. The only way i could get it to go was to do an address object rule, but that only allowed me to do one service. Couldn't add a service object group. We did get a unidirectional NAT rule in the upper table to allow 443 but having a weird ACL issue with it, so i feel like there's a better way / best practice to do this?

I know its Cisco 101 shit but every time i turn around they're re-fuckulating the way you have to do NAT / ACL.