There's not a way to programmatically add exceptions to the firewall. I confirmed this with AppleCare Enterprise.
On May 10, 2010, at 4:59 PM, Jason Halvorson wrote:

How I worked around it:

Built a preference file the way I wanted it. (Firewall preferences are stored in /Library/Preferences/com.apple.alf.plist). Using Composer, developed a .dmg which contains this preference file.

Wrote a script which:

1) stops the firewall
2) stops the firewall GUI (exact commands are in the Resource Kit)

And another script which:

1) starts the firewall
2) starts the firewll GUI (exact commands also in the Resource Kit)

Created a policy to run the first script before, then deploy the firewall preferences, then runs the second script after.

Worked like a charm. 10.6.3 caused some odd stuff to happen (firewall questions about items that were already in the GUI/in the preference file), so I ended up rebuilding the preference file on a 10.6.3 system, and now it's fine...

Hope this helps,

--Robert

@RobertHammen Your post about the Firewall preference file helped us. Thanks!