To clarify, ports 80 and 443 are required by the ACME spec; Caddy actually lets you change them to whatever you want, but you still have to forward ports 80 and 443 to your internal alternate ports then.
Or set up the DNS challenge which does not require any external ports.
But anyway, it’s worth noting that this is not a requirement unique to Caddy. If you let Caddy manage your certificates (recommended), then it will need 80 and 443 exclusively (if you don’t set up the DNS challenge).