Let’s Encrypt will issue for a publicly-resolvable FQDN even if it has a private IP address, if you use the DNS-01 authentication method (making DNS changes in your DNS zone). In this method Let’s Encrypt does not need to connect directly to your server in order to issue the certificate.
Let’s Encrypt can never issue for a non-public domain, an IP address, or a domain name that can’t be verified in the DNS. In the latter case you might want to create an internal organizational CA that your clients trust.
Using a different port for the deployed application is fine, as long as the protocol is actually HTTPS, because the port number is not encoded, represented, or constrained in the certificate in any way.