SSL Certificate Inspection: CA Signed Cert or Self-Signed Cert?

So I am trying to setup policies and of course almost all of them require SSL inspection enabled.

I did issue the cert from the domain controller which is self-signed and imported it to the firewall.

Of course it will throw an error saying that it is not a valid ssl cert unless I install that cert as Trusted Root on all PCs. If we get a cert from trusted CA then how would that work?

Would I be using any of the following information: Public IP: xx.xxx.xxx.xxx Domain Name: xyz.local (AD Domain) or xyz.com (A domain we own). Would SSL inspection still work if I get the CA signed cert for xyz.com domain?

I am pretty new to the SSL and certificates world so I have not much of an idea how things work.