i would really appreciate if Cisco could announce such changes upfront with some lead time and a defined implementation schedule. As API calls make use of region name when creating NTGs, this name change result in failing API calls.release management...

Yeahh thats a bit hidden in the policy. you find that as a sub object under the network tunnel group. expand the NTG and you will see it. good luck

you can associate a network tunnel group with an internal network in config screen of "add new internal" network. i didnt tried yet but good chance it will work i believe.

for SSE:  https://developer.cisco.com/docs/cloud-security/secure-access-api-authentication/for SCC: https://developer.cisco.com/docs/security-cloud-control/introduction/ 

check this article and sub chapters. these destinations should be exempted from VPN:Network Requirements for Secure Access