Is this an IOS-XR based question for the A9k or CRS?
It looks like you have a CPE that you want to connect directly some tcp/udp port between a private address and some public address do I see that right?
Generally if the connection originates from the inside, a hole is automatically created by the NAT logic in the CPE,
buf if the remote side wants to connect in (you need to pierce a hole in your ACL/FW too!!) you could create a static NAT entry something like this:
ip nat inside soruce static port etc
xander