An XSS attack here means that the attacker somehow must be able to compromise the HTML in the Ajax result. Assuming that the connection itself can be trusted (i.e. HTTPS) there are basically two options: sanitize the HTML in the client and/or make sure that there is no XSS in it in the first place in the server.
The latter option is preferred if you have control of the server, i.e. the server should not generate compromised HTML in the first place. How this exactly is done depends on your unknown web application. But the basic idea that you need to be clear what kind of inputs can be trusted and what not (i.e. can be influenced by the attacker) and then make sure to properly sanitize/restrict the untrusted parts, for example by not allowing HTML input from untrusted sources in the first place.