GUP is also a client so it needs port 80 to talk to SEPM like all others.
For clients to take updates from GUP. 2967 should be open.
***********************************************************************
When you make a computer as GUP , that means its providing a service, when you are providing a service, there is PORT (like door) associated with that,
If I say HTTP service, its on port 80 , DNS on 53, simillary GUP on 2967 ( Configurable thought !!)