Unfortunately xfs doesn't have an undelete option, so low-level recovery, like you already tried with PhotoRec, seems the only option.
About read-only mounting of the disk in the NAS, that might be possible, but needs some scripting. Using ffp alone is not enough, as the disk is already mounted before ffp starts. The trick which can be used is that usb_key_func.sh
is called before the data partition is mounted, which gives the opportunity to exchange the mount function itself by a script, which parses the mount commands, and add a ro flag when the data partition is mounted.
However, I don't know what the firmware will do with a read-only data partition. It always tries to write some logfiles and stuff, which will fail, of course.
How many effort and money are you willing to invest? My approach would be to first make a low-level backup of the whole disk, and put the original in a safe (figuratively. that safe).
Then let a script run on that copy to fill all existing files with zero's, to get around the problem that PhotoRec in raw modus cannot ignore existing files. And finally let PhotoRec recover the files to a 3th disk.