Hi, Where are you based and who is your isp ? It all comes down to these 2 main questions tbh first as that will determin whether you can do away with your isp router amd soley use your own routers or if you will be stuck behind a isp router.

Unfortunately i cant answer if you can use a vpn on that router in AP mode and im sure someone more knowledgeable will be along to answer that for you. 

some isp's  like Sky uk as far as im aware of you cant use your axe75 via the ONT as they use mer61 i believe, But then i did read a post where someone had managed to get their router to work on sky broadband using a tp link router directly connected to the ONT terminal on here somewhere.

Im on BT and when i set up my tp link router i connected it straight to the ONT and went through the set up and entered the log in details for bt and never used their router. 

I use only my own equipment ( all tp link)

I would advise If you can ditch the isp router and use your axe75 indoors, you could just connect the ethernet from where your isp router was and have the axe75 indoors and then hard wire to the Xbox in your shed. 

You should then be able to eliminate the double NAT but you won't possibly have wifi in your shed depending on how far/signal reach is. 

But what you can do if funds allow is buy a cheaper wifi6 tp link router for your shed but connect it to the etherent from inside of your house set that up in AP mode and then have wifi plus 4 extra ports for the likes of your Xbox