Finally it works for me like following:
====
    # From elsewhere to Spam folder
    imapsieve_mailbox1_name = Junk
    imapsieve_mailbox1_causes = COPY APPEND
    imapsieve_mailbox1_before = file:/var/vmail/sieve/report_spam.sieve

    # From Spam folder to elsewhere
    imapsieve_mailbox2_name = *
    imapsieve_mailbox2_from = Junk
    imapsieve_mailbox2_causes = COPY
    imapsieve_mailbox2_before = file:/var/vmail/sieve/report_ham.sieve

   # HAM Outlook
    imapsieve_mailbox3_name = Inbox
    imapsieve_mailbox3_causes = APPEND
    imapsieve_mailbox3_before = file:/var/vmail/sieve/report_ham.sieve
====

Seems that processing  APPEND event in imap_sieve plugin does not consider "From" mailbox at all. Because of it in my previous try-on to modify causes in rules moving mail from Junk folder led to the activate of both rules.

I listed both COPY and APPEND in imapsieve_mailbox2_causes, it works fine for me:

Concern: I think this behaviour is not accurate on technical side.

With this setting, APPENDing email to INBOX always triggers the report_ham action.

- If the APPEND is triggered by moving message from Junk to INBOX, it's ok. But what if user moves message from Sent/Draft/Trash to INBOX?
- [this one needs testings] What if user is importing local emails (not stored in IMAP mailbox) by drags (local) messages to INBOX folder (or something like this)?

I understand if message is moved to INBOX, it should be clean, the question is: do we really need to learn it (as ham)?

I will set "imapsieve_mailbox1_causes = COPY APPEND" in Dovecot (in iRedMail Easy platform), this is perfect. Thanks again for the sharing.

But i will not add "imapsieve_mailbox3_*" for now, it's not accurate.