Can't lock Profile Manager devices outside of server WiFi network
Please enabled all the applicable ports.

Apple's documentation (http://support.apple.com/kb/ht5302) also lists the service needing TCP ports 2195, 2196, and 5223 for the service to send/receive push notifications, which AFAIK is how the service communicates with clients.