Sophos XG Firewall placement

Hey,

After some advice as to where I should place a new Sophos XG Firewall?

Currently I have the normal Unifi setup:

ISP Fibre ONT > USG WAN > USG LAN > Unifi Switch > rest of the internal network

To integrate the XG should I do

ISP Fibre ONT > USG WAN (VLAN10) > USG LAN > Sophos In > Sophos Out > Unifi Switch or

ISP Fibre ONT > (VLAN10) Sophos In > Sophos Out > USG WAN > USG LAN > Unifi Switch

I'd prefer to keep the connection to the ISP going through the USG first then onto Sophos if that's best.

I want to include the firewall to monitor the traffic deeper and restrict websites etc as the kids get older.

Thanks