ICMP from clients to relays is needed for Automatic Relay Selection, otherwise it is just port 52311.
Technically it is not bidirectional 52311, but that would work as well. Clients (and relays) should accept UDP over 52311, while relays & the root server should accept TCP over 52311.
Hardware firewalls should allow 52311 UDP/TCP bidirectionally.
Related: Urgent, what is the network requirements for IEM server and client