If you want to interface with the controller electronics — ie. to communicate with the controller or console — then you will definitely need Microsoft's blessing.
The expansion port pinout, protocol, and API for communication with the controller/console are not publicly available, so you would need to be a registered Xbox One developer to start with. There may be additional licensing or technological restrictions that require Microsoft's assent or participation to produce your own accessories that will work with the device.
(I don't want to stray into details that might be guarded by NDAs. Suffice it to say I worked on a project where we developed a custom controller attachment that we could not have accomplished without Microsoft's approval)
If you just want to clip your add-on onto the controller, without drawing power from it or communicating electronically, then that's less clear to me. I don't know to what extent the physical shape of the controller or its interconnection points might be protected by patent, trade dress, or other intellectual property laws in the relevant jurisdictions.
It's conceivable that if you made a non-communicating attachment that Microsoft objected to, they could send you a cease and desist notice or pursue legal action against you. Whether you could successfully defend against such an action is a question you should take to a lawyer for a more informed opinion.