Hello, in the dmz server deploy the web adaptors for portal and server, this way you do not need to open any ports, the only ports that need to be open for inbound/outbound traffic is the https 443 port for the IIS webserver, you can even close http 80 port. I hope this helps.
| Marcelo Marques | Esri Principal Product Engineer | Cloud & Database Administrator | OCP - Oracle Certified Professional | "I embarked on my journey with Esri Technology in 1992, and since 1997, I have been working with ArcSDE Geodatabases, right from its initial release." | “ I do not fear computers. I fear the lack of them." Isaac Isimov |