For years, our only formal recommendation when dealing with outbound IP traffic restrictions from a PBX was “don’t do it”. I think as a general rule that still works, but there are, of course, many environments where that is not workable or even permitted.
As of today, we have a wiki page outlining external resources required by the PBX for install and maintenance.
https://wiki.freepbx.org/display/PPS/Allowed+IPs+for+PBXact+Upgrade