How to use UTXO of xpub derived addresses? I'm new in Bitcoin, this is something I'm confused with.
If we are deriving children, i.e. public keys, from xpub, without private keys, for the purpose of receiving outputs, how are we able to spend UTXO if we don't have private key?
In this example:
https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch05.asciidoc#using-an-extended-public-key-on-a-web-store
xpub is set up on server to generate public keys to receive money on e-commerce website. But how do we access that money if we don't have private keys?
Gabriel’s HD wallet offers a much better solution through the ability to derive public child keys without knowing the private keys. Gabriel can load an extended public key (xpub) on his website, which can be used to derive a unique address for every customer order. Gabriel can spend the funds from his Trezor, but the xpub loaded on the website can only generate addresses and receive funds.

The link you mentioned describes how you can use XPUB to get new address for each order on your website and the address will belong to your wallet setup maybe on a hardware wallet or elsewhere to spend.

But how do we access that money if we don't have private keys?

You don't access it on the web store but you access it using hardware wallet or maybe wallet setup on a different machine etc.
You can try this with btcpayserver