You're probably right, but blocking doesn't seem to be a problem. I'm going to leave it like that for now. Not sure I would need any more firmware updates for hardware which came out 3-4 years ago anyway, but I think enabling 13.224.195.59:443 for the devices only (not the controller) would trigger and download firmware updates.