From what I read at the below link, UPnP is unlikely to help you anyway. You can tell this by the alternatives which it suggests that you put the Xbox in the DMZ or to forward ports from your router to your Xbox.
https://support.xbox.com/en-US/help/hardware-network/connect-network/upnp-not-successful
By these suggestions, you can deduce that the service is intended to hit your Xbox directly from the internet but this is unlikely to be successful with the use of CGNAT.
Historically, ISPs have a pool of IPv4 addresses which they use to provide customers with a dynamic IP address. These IPv4 addresses are routable on the internet so other Xbox users can hit your device. Due to the shortage of IPv4 addresses, there has been a move to CGNAT where customers are provided with a non-routable address and many customers share the same IPv4 address going out to the internet so there is no hope of other servers hitting your Xbox because it will have no publicly routable IPv4 address.
You can make outbound connections and receive data back on that connection via NAT, but no inbound connection can be initiated to your Xbox because they will hit your exit IPv4 address but that gateway will not know which customer to send those packets to so will do whatever the firewall is configured to do (you may as well assume those packets are dropped as they will anyway not reach your router).
If you find any of the above to be false or you find some way to get around the obstacles which I have outline, I would be very happy to hear about the strategy as I'm well aware my knowledge is incomplete in this area. Good luck! 🤓
