Add file path to Firewall Payload

Our ediscovery team has us pushing out an agent.  After the install, we see a prompt to allow the agent svc to allow incoming connections.  We are force enabling the Firewall with the Firewall payload in a configuration profile.  I know I can add Applications to the list with its bundleID.  How can I add a file to the allow connections?  

Since we are pushing the config to turn on the firewall, whenever I run /usr/libexec/ApplicationFirewall/socketfilterfw I get a message "Firewall settings cannot be modified from command line on managed Mac computers."

Any help would be greatly appreciated!