You append the XAS information to the same option that provides the S1 address, retry action and retry interval. Here's a passage from the NTP (Sorry for the sloppy formatting -- you may want to copy/paste to notepad to make it more readable).
-----------------------------------
When using the Full DHCP option on the IP Phone 2004, the IP address
of an XAS can be provided. To do this, append the XAS IP address and
port to the Nortel DHCP option currently used to specify the first and
second server IP address, ports, and retry and action codes. For Graphical
XAS, the action code (aaa) and retry count (rrr) must be appended. For
Text XAS, it is not necessary to append these values.
The format of the exchange application server’s IP address and port is:
iii.jjj.kkk.lll

pppp,aaa,rrr
The XAS port action code (aaa) byte values are:
• 1=Graphical XAS
• 0=Text XAS
The port field is processed if Graphical XAS is selected, but ignored for
Text XAS (the fixed text port is used). XAS always uses port 5000.
Note: If the XAS port action code (aaa) byte value is 0 (Text XAS), then
the port action code and retry count fields are not required. If the XAS
port action code (aaa) byte value is 1 (Graphical XAS), then the port
action code and retry count fields are not optional and must be included
in the configuration string.
For example, the format of the option used to specify Connect Server 1,Connect Server 2, and the exchange application server (XAS) is:
Nortel-i20xx-A,iii.jjj.kkk.lll

pppp,aaa,rrr;iii.jjj.kkk.lll

pppp,aaa,rrr;iii
.jjj.kkk.lll

pppp.