Generate form from XML
I'm not sure about D8, but for a D7 site I would read the XML file within a hook_form_alter() function, and use this to select enabled or disabled each form element depending on the rules set forth within the XML.

Of course as lovely, or convoluted as that sounds, it's a pretty nasty performance hit to show a form so caching would be important here.

I hope I understood your question correctly.