Rules in .htaccess only if the requested URL is /wp-admin

Try something like this instead:

<If "%{THE_REQUEST} !~ m#\s/wp-admin#">
Header add Content-Security-Policy "default-src 'self';"
Header add Content-Security-Policy "script-src 'self';"
</If>

This should set the two headers only when the requested URL does not start with /wp-admin.

The check is against THE_REQUEST (as opposed to REQUEST_URI) since REQUEST_URI changes when the URL is rewritten by the WordPress front-controller. THE_REQUEST is the first line of the request headers (a string of the form GET /wp-admin/something HTTP/1.1) and does not change when the request is rewritten.

Maybe it would be nice if a loggedin user is on the website that the lines also not be executed.
(I need to do it with htaccess.)

You can’t reliably do this with .htaccess. In .htaccess you can only determine whether the authentication cookie is set, not whether it is set correctly.