What are the minimum required firewall rules between the Unified Access Gateway appliance and back end components?

A company is proposing:
All external network users will access their desktop using BLAST protocol. No other protocol will be used.
Device will NOT be allowed to be attached to PCs while users are outside of the internal network.
VMware Unified Access Gateways will be deployed behind a secure network and strict security requirements implemented.
A consultant was brought in to determine backend firewall port requirements to support the proposal.
What are the minimum required firewall rules between the Unified Access Gateway appliance and back end components?
A. Unified Access Gateway Appliance to View Connection Server or Load balancer on port 443Unified Access Gateway Appliance to Remote Desktop on port
8443
B. Unified Access Gateway Appliance to View Connection Server or Load balancer on port 443
Unified Access Gateway Appliance to Remote Desktop on port 22443
Unified Access Gateway Appliance to Remote Desktop on port 32111
C. Unified Access Gateway Appliance to View Connection Server or Load balancer on port 80
Unified Access Gateway Appliance to View Connection Server or Load balancer on port 443 Unified Access Gateway Appliance to Remote Desktop on port
8443
D. Unified Access Gateway Appliance to View Connection Server or Load balancer on port 443Unified Access Gateway Appliance to Remote Desktop on port
22443