Following up with what I received from support (edited for clarity):
If you’re using a Private Network Application, create the application first (Access>Application>Private Network). This will create Gateway Network Policies (Gateway → Policies → Network). Use the greater than or equal to and less than or equal to fields in multiple rules to cover multiple ranges.
As an example, the first rule would look like this:
Then 2nd would be another allow policy, but with different ports.
You would have to create 3 separate Allow rules for Active Directory based off the MS documentation:
Service overview and network port requirements - Windows Server | Microsoft Learn
Rule 1: Destination port In 135,389,445,500,636,3268,4500,9389
Rule 2: Destination Port is greater than or equal to 1024 And less than or equal to 5000
Rule 3: Destination Port is greater than or equal to 49152 And less than or equal to 65535
Rule 4: Block the rest