When you push out an agent it uses 80 or 443 to get to the device then it uses file share to push out to admin$.
This isn't quite right - when you push an agent, 80 and 443 (by default) are not used: only normal protocols to copy the file to the target machine and create the regidtry entries necessary to install it.
Once installed, the agent uses 80 and 443 to communicate with the server.
Once the agent is installed. what port does it use to update the dat? Does it reverse and use file sharing ports to grab it from \\server\share or does it pull it over 80 / 443?
The port used for DAT updating depends on the type of repository being used to provide the updates. If it's the ePO server itself, then the agent will use the agent-to-server port, which is 80 by default - but if it's a superagent repository, it will use the agent wakeup port (8081 by default), if it's a UNC share then it will use the SMB ports, and so on.
Thank you for clearing it up.