Separate networks in Sophos RED.

Could be possible via VLAN, if you have a VLAN switch on the RED End. 

Okay, so I would create two RED interfaces in XG and each one with its DHCP range to deliver IP to desktops, right?

Where do I put the VLAN ID and how do I associate it with each internal physical interface of RED?

RED20 will bridge all LAN Ports together to one LAN Port. You can attach on XG multiple VLANs on those 4 Ports. 

RED60 can have different VLANs on different ports. 

Nevertheless in RED20, you need to have a Switch connected to the RED20, which can handle VLAN.