You don't have to enable ANY ports for the basic functionality.
The default communication model is POP only, ie. the client is contacting the server, and not vice versa.
There are two exceptions to this:
- the "Apply now" feature in the console
- remote access to the virus chest.