Since NTA is showing more traffic than NPM I would focus on device configuration.
First of all make sure that you have setup on device interface to export only ingress or egress traffic. If you are monitoring both of them the traffic would be duplicated as explained here: Double traffic? Correctly only one of them should be used otherwise the traffic will be duplicated. Another problem could be that device is not sending data to NTA periodically each minute. Can you please check that on the device is set "ip flow-cache timeout active 1".
Hope this will help,