Ports TAG or NOT

I am installing a second XGS at several locations.  I want to take a copper connection coming from ISP and plug it into a switch port (1), and then plug in XGS1, and XGS2, into Sophos switch ports (2,3).  I want these ports to be separate from other ports, so that Port 1,2,3 can only see each other, nothing else.

The connection from ISP has multiple VLANs attached to it, each Vlan representing another location, so these must be kept intact.

If I am not using VLAN, 100, I can delete ports 1-3 from VLAN 1 and then add them to VLAN 100.  Should I tag 100 or not?

I have NO ability to change settings on ISP equipment, so it will not know about VLAN assignment.

I want to add Second ISP.  I want to use ports 4-6 for that as well, VLAN 101.

Thanks for advice.