Admin can refer this to allow a single incoming TCP port in the firewall using windows profiles.
Step: Go to Endpoint Manager → Configuration Profiles and select Profiles Menu .
Step: Select a name of a profile applied to your device that requires changes.
Step: Please ensure that "Firewall" component is available in profile. If not please add it by clicking appropriate options from “Add profile section”
Step:In Firewall Select Application Rules → Add
NOTE: In this by default we are blocking the In and Out Connections for all the Applications by Applying this ruleset and allowing Incoming connection over Only One Single TCP Port.
BLOCKING IN AND OUT CONNECTIONS FOR ALL APPLICATIONS:
Step  : i) An Application Rule Dialog box appears in it Select All Applications from the dropdown list adjacent to Name Space box
ii) From Use a cutom ruleset dropdown list select Ruleset
Step:i ) After Selecting Ruleset from Use a cutom ruleset dropdown list an dropdown list appears in Adjacent.
ii) Select Blocked Application from the Dropdown list and select OK.
Step:Under Rules Section the Newly added Custom Ruleset will be displayed and then Select Add Rule. A Firewall Rule dialog box appears.
ALLOWING INCOMING CONNECTION OVER ONLY ONE PORT
Step  : i) From Protocol Dropdown list select TCP
ii ) From Direction Dropdown list Select In and Press OK
Step  : i) In Frewall Rule Dialog box select Destination Port
ii) Under Destination Port in dropdown list type select "A Single Port"
.Step  : i)After selecting the A Single Port from type dropdown list A Port Number Space box appears.
ii) Specify the port number of your choice for incoming TCP Connection Ex : 1
Step :Select rules check box and press 'OK'.
Step  : Select application checkbox and click Save to apply the rule to the profile.
Now, profile will be applied over the Endpoint Manager device in 5 minutes.