The XenApp server agent can be configured in two different ways.
- either installed locally on one delivery controller on each site (which doesn't require network access)
- or it can be given a comma separated list of controllers to connect to on the command line (which does require network access)

We do list this as a pre-requisite as it's needed to run the XenDesktop discovery & inventory actions which are also needed for complete inventory of their Citrix environment. It's mentioned in the documentation under point 12 on this page：
https://docs.flexera.com/fnms/EN/WebHelp/index.html#topics/FIB-PortsAndURLs.html

Some customers work around this requirement before by manually (or through some automated process) running the InventoryXenDesktop.ps1 script (which can be found in the inventory beacon's installation path) locally on each delivery controller and uploading the generated .ndi and .vdi files.

Rather than using PS remoting, the XenApp agent uses the -AdminAddress parameter to connect to a remote machine when executing commands from the Citrix PowerShell SDK. The broker service on the delivery controller receives requests which I believe by default is http on port 80. There is some more information in Citrix documentation, e.g.

https://support.citrix.com/article/CTX222326

https://docs.citrix.com/en-us/xenapp-and-xendesktop/7-15-ltsr/technical-overview/default-network-ports.html