Please refer to these two McAfee support articles:
KB66797 - Ports needed by ePO 4.x and ePO 5.0 for communication through a firewall
KB56386 - Environmental requirements for agent deployment from the ePO 4.x server
The initial agent deployment is an SMB push through TCP445.
All subsequent deployment tasks are agents pulling the packages from the server via the agent to server communication port using the SPIPE protocol. This is normally 443 for agents greater than version 4.5.