Lot's of ways to skin this cat, but I'd start with questioning why you're monitoring inbound email at all with DLP. You probably already know that there are IP and L7 filters on the SMTP Protocol for your Network Monitor which could effectively eliminate inbound email from inspection altogether.
If you're going to monitor that traffic, then I'd suggest you do what you want through Severity assignment, and keep one policy. Clearly, since the volume of inbound email is probably overwhelming from an incident perspective, you should be setting these to a severity of "Info", as I can't imagine anyone is reviewing these incidents actively. If that's the case, and using an SSN rule as an example, the policy could look like this:
Policy Name: SSN via SMTP
Rule 1: Inbound SSN
Severity: Info
Rule: Data Identifier for SSN -AND-
Protocol = SMTP
Rule 2: Outbound SSN
Severity: High
Rule: Data Identifier for SSN - AND -
Protocol = SMTP -AND -
Sender/User Matches Pattern: *@yourcompanydomain.com
Then, your email response can be set to send under the condition that the incident severity is "High". Info level SSN incidents over SMTP (which is now essentially anything that isn't coming from your domain) won't get a response.
The key here is that the highest severity for all rules matched will be assigned to the incident. While an "outbound" email will match both rules 1 & 2, it will get the highest severity, which is based on the match against rule 2. While an "inbound" email (one not from your domain) will only match rule 1, hence get an "Info" severity, which won't get a response (based on your response rule configuration).
I think this is cleaner than having two policies, since you're still going to need another SSN policy in this case to look at the other protocols.
~Keith
p.s. If you do this, do yourself a favor and set up a custom attribute which you assign a value of either "inbound" or "outbound" to through an auto-response rule based on severity. You'll be able to report on this activity a little better through summarization, and it's more obvious to an end user.