Azure Devops x On-Premises
What are you trying to achieve?
If your goal is to run build agents to execute pipelines on premises, then you don't have to allow inbound access. Build agents will query Azure DevOps for any new jobs, so the connections are actually outbound.