Model :

Hardware Version : Not Clear

Firmware Version :

ISP :

On the FAQ it says:
"Make sure firewall doesn’t block ports 8088, 8043, 29810, 29811, 29812 and 29813.
Should your EAP controller is installed on a computer behind NAT router,
make sure the above mentioned ports are opened for that computer."

Which ports NEEDS to be open for the controller to monitor and manage the AP? Ex. if you do not want to open the web management of the controller to a subnet, you could potentially exclude opening ports 8088 and 8043.
Is it possible to exclude opening any of these ports, and what would not work if you exclude the different ports?
Also, does the opening need to be for TCP or UDP, and is the traffic between the AP and controller encrypted?