Restrict range of dynamic ports available to SQL Server
Here's the start of a PowerShell solution as I mentioned in the comments:

$instanceId = "&lt;Instance ID&gt;";
$registryKey = "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\$instanceId\MSSQLServer\SuperSocketNetLib\TCP\IPAll"
$portNumber = (Get-Item $registryKey).GetValue("TcpDynamicPorts");

netsh advfirewall firewall add rule action=allow localport=$portNumber protocol=TCP dir=in name="SQL Server Database Engine ($instanceId)"


I'm not sure if this is going to be appropriate for the exact situation, but it might help someone out there.