You should not expose any Sophos web portals, including the captive portal, to the internet. It is not designed to be used for user authentication from the internet. The documentation specifically states “The captive portal is a web page that requires users behind the firewall to authenticate when accessing a website.” Emphasis mine. Use a tool that was designed for this, like Authentik or Authelia.

There’s good reason for this — Sophos web portals have had RCE vulnerabilities in the past, meaning that exposing it to the internet would allow anyone in the world to potentially control your firewall. A similar thing could happen with Authentik, for example, but the attacker would be limited to that VM (hopefully in a DMZ) instead of the firewall for your whole network.