Need way to access NAS behind xg firewall that has 100.77.x.x as ip (as seen from interfaces, but 112.201.x.x from https://www.whatsmyip.org)

First step, turn on DynDNS on XG. https://community.sophos.com/kb/en-us/123126

This would report the 100.77 to Sophos DynDNS server. 

But the question is more likely, what your ISP is doing. Some saving techniques to save IPs? You need to figure out, what the ISP is using. Only way to build a DNAT.

Reading some other forums about what my ISP is doing, they seem to say the isp is changing into CGNAT.  Don't know what that is, but I believe it's an internal IP?

Looks not good for you mate... 

https://en.wikipedia.org/wiki/Carrier-grade_NAT

Critics of carrier-grade NAT argue the following aspects:

• Like any form of NAT, it breaks the end-to-end principle.^[5]
• It has significant security, scalability, and reliability problems, by virtue of being stateful.
• It makes it impossible to host services.
• It does not solve the IPv4 address exhaustion problem when a public IP address is needed, such as in web hosting.

I guess you need to figure out a way to workaround this.

One would be... Pay more money to ISP to get a business contract with Public ip (Or switch the ISP?).

Another is a little appliance in public hoster setups and build a VPN to this place. 

For example: Sophos Home XG in azure. Build a VPN to this place. DNAT the traffic going to Azure. Azure will route traffic through VPN to your XG. 

I am sorry, but both approaches are based on "money spending"... 

Looks not good for you mate... 

https://en.wikipedia.org/wiki/Carrier-grade_NAT

Critics of carrier-grade NAT argue the following aspects:

• Like any form of NAT, it breaks the end-to-end principle.^[5]
• It has significant security, scalability, and reliability problems, by virtue of being stateful.
• It makes it impossible to host services.
• It does not solve the IPv4 address exhaustion problem when a public IP address is needed, such as in web hosting.

I guess you need to figure out a way to workaround this.

One would be... Pay more money to ISP to get a business contract with Public ip (Or switch the ISP?).

Another is a little appliance in public hoster setups and build a VPN to this place. 

For example: Sophos Home XG in azure. Build a VPN to this place. DNAT the traffic going to Azure. Azure will route traffic through VPN to your XG. 

I am sorry, but both approaches are based on "money spending"... 

Thank you.  That's what I thought.  Appreciate the confirmation.