I will then have a spare NIC and I can assign that NIC to vSwitch 1. Should I move Sophos LAN to Management Network (vSwitch0) or Management Network to Sophos LAN (vSwitch1). Does it make any difference which to move where and why.
You should leave vSS 0 with its existing uplink and the existing management vmkernel port. Create a virtual machine port group on that same switch. Move the other uplink to vSS 0 afterwards.
Should Sophos LAN then be assigned with VLAN ID 4095 in that case?
The LAN interface for that Sophos VM should be set however you set up the network where the uplinks are provisioned. For example, if your management vmkernel port does not have a VLAN ID associated with it, then you must have set the upstream ports to access mode. Configure the Sophos LAN interface the same way.
I just want port groups (client, guest, server) assigned by VLAN to be isolated between each other and my Sophos LAN but still have connection to the internet.
I don't know what it is you're trying to accomplish here and how this Sophos VM fits into the picture, but if you want isolation between those VLANs and yet still allow systems on each to talk out to the internet, then that becomes a matter of routing. You'll have to handle the routing outside of ESXi and configure your rules appropriately.