but files are still created outside the xmplay folder.
Such as? XMPlay itself don't writes anything in the Registry nor %APPDATA% or anywhere.
The only exception is buggy xmp-ym.dll plugin, which writes and multiplies his xmp-ym.ini literally everywhere, including Music directory.
Winamp plugins/visualisations - yes, some may write its settings in the Registry or even %APPDATA%, but that's not player's fault.
Also, if listen Internet radios, SOME (rare) stations can write its cookies in system Cookies folder, or when listen from net share, depending on settings, cache may be written in system internet cache directory, but again, that's not XMPlay's fault, it just uses system's functions for Internet streaming.