We're migrating from on-premises MobiControl to Cloud MobiControl and want to confirm firewall requirements.

Our understanding: devices just need outbound HTTPS (443) to the Cloud instance.

Questions:

1. Can all device traffic be NATed behind a single firewall IP, or do scanners need individual public IPs?
2. Should we allow-list specific FQDNs instead of IPs, since cloud IPs may change?

Thanks in advance for any guidance from those who've done this migration.