sysNAND is just what people call the internal firmware on the 3DS.
Gateway supports all games but some titles may require a newer firmware, obviously you can't update your 3DS' firmware, emuNAND is a way around that.
Hold L when entering Gateway mode, and select "format emuNAND", this will delete all the contents on your 3DS' internal SD so make sure to back it up first.
From then on when you boot Gateway mode it will boot into emuNAND which is a copy of your NAND stored on the SD, and which you can update freely without losing your hacks. When you update always make sure you update from system settings or you may update your sysNAND by accident, also make sure the version in system settings says "GW3D" in front of it, signifying that you are in emuNAND (or you can check by opening the multiROM menu which should say SYS/EMU depending on which NAND you are in.)
Exiting system settings or opening data management and exiting that will kick you back to sysNAND so once you've verified that you are in emuNAND avoid doing those things and go directly to system update.
There are certain CIA games (newer releases) that won't work because they have not been properly cryptofixed so the console can't decrypt them, to get around that either use a .3DS version of the game, use a cryptofixed version, or go to the eshop page for the game (only works if it's of the same region as your 3DS) which causes it to download the encryption key and the game should work after that.