I wonder how the persistence session works for MQTT clients without public IP, particularly those IoT devices with NB-IoT sim card. For example, I have device A subscribed to Topic-X. I wonder how does the broker relay the message of Topic-X to device A.
There is no link between session persistence and a clients IP (public or otherwise).
When a client connects it identifies itself with a Client Identifier and the server will use this to link the connection to a session as per the spec:
In order to implement QoS 1 and QoS 2 protocol flows the Client and Server need to associate state with the Client Identifier, this is referred to as the Session State.
Note that connections are always established by the client (the server will never attempt to connect to a client). The server will (subject to subscriptions and settings like "Session Expiry Interval") store messages whilst the connection is down (these messages will be transmitted when/if the client reconnects - again subject to things like "Clean Start").