Setup STAS Suite on a Member Server and need to know which firewall port to open on Domain Controller

First of all, The ports are open on XG, if you enable Device access --> User Authentication. So you do not need to open any ports on XG itself.

Did you work yourself through this KB? https://support.sophos.com/support/s/article/KB-000038628?language=en_US

STAS shows you, which ports need to be open. 

Right, so that links back to article that shows what ports to open on the Domain Controller, do I open those same ports on the member server then and NOT the domain controller?

Also, I created a sophosstas user account in AD for STAS suite connection to AD. Is it normal to see that user as a "Live User" list in STAS Suite logged in from the IP of the XG unit?

There is a collector and a agent. 

The collector part communicate to XG. the agent communicate to the DC. 

You can split both up. And with STAS 2.5, you can place both on a external server, not DC. 

Agent will use the Authentication, to login to DC to get the login information. As far as i know, this should be port 139. (Basic Auth). 

You should not see XG itself logged in. Thats odd, but you can investigate this further by looking into the STAS live log. 

In the case of multiple domain controllers, do you need to have one agent per DC?

https://support.sophos.com/support/s/article/KB-000035730?language=en_US

This page hasn't been updated for 2.5 apparently so it is unclear how the agent communicates with multiple DCs.  There are two seemingly conflicting configuration boxes on the Agent page.  

Domain Controller IP
Domain Controller to be Polled

The documentation appears to indicate we should be using "Domain Controller IP" but there is only one IP to enter.