The term firewall describes a broad category of products for a variety of use cases. There are simple packet filter firewalls using iptables or similar but also so called Next Generation Firewalls which do application level analysis. And there are Intrusion Prevention Systems, Unified Threat Management products, Industry Firewalls ... and also Secure Gateways. Sometimes these names refer to their task, sometimes to a technology and sometimes they are just marketing lingo. But all of these various kinds of network firewalls have in common that they are used for separating networks at various kind of layers: from packet to application layer.
1) What is the difference between an email security gateway and firewall ? Could an email security gateway be considered as an smtp proxy ?
Mail Gateways or Secure Mail Gateways provide a separation at the Application Layer by analyzing the context of mail delivery and the content of mails transferred through a network boundary. This way they help to protect the inner network against malware, phishing, spam etc but can also help to detect data leakage from inside to outside using emails. While there are standalone Secure Mail Gateways or cloud based solutions the necessary functionality is often included in modern enterprise firewalls too. But, like with firewalls in general the quality of the solutions can vary a lot even between products which claim to have the same general features.
2) Does an email security gateway run an MTA or a UA?
Secure Mail Gateways are commonly implemented as MTA, i.e. explicitly configured as MX for incoming mail and as the outgoing mail server in the mail clients. But, there are also products which can be used in a transparent way, i.e. which are setup in front of an existing MTA with no additional configuration in DNS or at the clients.
3) How does it detect spams and phishing emails?
This by itself is a broad question. But, to mention some techniques: there is blacklisting of IP addresses which are known to deliver unwanted or harmful mails (DNS-BL - DNS based blacklists). There is Greylisting to temporarily deny receiving some mail in the hope that spammers will just give up. There is the use of SPF, DKIM and DMARC to detect sender spoofing. There are various content based filters which for example compare received mails with known bad mails received in honeypots or check if they contain links to known spam or phishing sites. And while these are probably the most used and well known techniques this is by far not an exhaustive list of techniques used.