Hey,
I am going with the assumption that you would be triggering the refresh of AAS via ADF , below are the answers to your queries:
1) When AAS firewall enable , do I still need install a self-host IR VM to do the refresh ?
Ans: Every ADF region has some specific IP ranges which are published by MSFT, you would need to whitelist those IP ranges in the firewall
2) Can use data factory MSI ?
Ans: techtalkcorner.com/azure-data-factory-refresh-analysis-services/
3) Are there incremental refresh ?
Ans: Based on my understanding , its not possible and you would need to do partitions for partial tables processing if need be
https://learn.microsoft.com/en-us/answers/questions/251394/how-to-incrementally-refresh-azure-analysis-servic.html
https://stackoverflow.com/questions/60078345/azure-analysis-services-incremental-refresh
4) And how to mention what credential in the model to get data from Azure sql database ?
Ans: That is a part of AAS deployment. You can access the Azure SQL DB from AAS via SQL auth creds