Those ports should be outbound only, not inbound. It sounds counterintuitive, but Apple designed it specifically this way; the server initiates the connection with Apple, and then Apple sends the data back to the server over that connection. It works the same way with the iOS and Mac managed clients, but via port 443. I've seen a lot of documentation that was inconclusive, but we don't have any of those ports open internally, and our environment works fine, and receives push notifications rather quickly.

We had similar concerns at first, but the ports can be further locked down to only talk to Apple's servers. I forget the IP's, but it's 17.x.x.x. I'm sure your account rep can give you the address you need to limit the ports to.