What type of devices are you managing? There are different requirements based on the OS and management style. For instance, devices managed under Android Enterprise often need access to Managed Play servers in addition to the MobiControl instance. 

Matt,

Thanks for replying.  The devices are all Zebra devices running Android 8.1 (or higher) and Android Enterprise.  Our apps so far are directly deployed (ie not through the play store) so we currently have the Play store disabled, but I suppose that could change in the future.

Thanks

Do you have an Android Enterprise binding associated with the MobiControl instance and Enrollment Rule? Are you assigning Managed Play service accounts during enrollment or are you skipping that step? If you are assigning service accounts during Enrollment the devices and server will need to be able to communicate with Managed Play. If you're bypassing that step and want to purely rely on direct app installation via Packages and Profiles then you won't need that communication channel open. 

We are bypassing that step - no Managed Play service accounts.

I assumed with that configuration then all the requests to google will be ok to be dropped at the firewall and all of the device content will be from SOTI packages.  The range of SOIT addresses makes me scratch my head though because the ones I am seeing in my logs do not match the SOTI docs at all.