Port Question

Question

We're in the process of deploying Lion Server 10.7 with a public facing IP in order to support/manage iPads in the field.   The in-house security office ran an automated security scan on the server.  The portion summarized below is focuced on open ports. As you can see, a good number of "hits" are from ports the security software couldn't identify.  Other hits ID'd the port but not the process.  I have identified all of the MEDIUM level ports as required with the exception of port 22.  However, while the security staff is eyeballing ports 8088, 137, 138, 311 and 80 (I have raised eyebrows for these), I'm most concerned with their wanting to arbitrarily "close off any/all unnecessary ports".  Hence my two questions: 
1) Can anyone help me ID Lion Server's "unecessary" ports?
2) How exactly do you turn off Lion Server ports?
Risk Factors: MEDIUM
Port 22: SSH
Port 80: HTTP
Port 311: Serves core server functions
Port 443: Secure sockets or https
Port 8088: Software update service.
Risk Factors: NONE
5268 Service detection Help Request: Risk Factor NONE
Port Unspecified: An HTTP proxy is running on this port.
Port Unspecified: An Web Server is running on this port.
Port Unspecified: An SSH Server is running on this port.
Port Unspecified: The remote service could be identified.
Port Unspecified: The remote service encrypts communications.
Port Unspecified: A web server is running on this port through SSLv3.
Port Unspecified: An SSLv3 server answered on this port.
Port Unspecified: This port supports resuming SSLv3/TLSv1 sessions.
Port Unspecified: This port supports SSLv3/TLSv1.0.
Port Unspecified: A web server is running on this port through TLSv1.
Port Unspecified: A TLSv1 server answered on this port.
Risk Factors UNKNOWN:
Port Unknown: 49177/udp
Port Unknown: 51877/udp                                                                         
Port 5268: Service Detection HELP Request                                              
Port 53094 Unknown Use                                                                           
Port 53403 Unknown Use                                                                           
Port 5352 Unknown Use                                                                              
Port 54422 Unknown Use Use                                                                      
Port 58230 Unknown Use                                                                           
Port 58231 Unknown Use                                                                           
Port 60449 Unknown Use
Port 60807 Unknown Use
Port 625 Unknown Use
Port 63449 Unknown Use
Port 64224 Unknown Use
Misc
Port Unspecified: The remote web server does not return 404 error codes.
Port Unspecified:  A CIFS server is running on this port.      
It is possible to get the remote operating system name and version (Windows and/or Samba) by sending an authentication
request to ports 139 or 445
Service Detection – Unspecified Port: A vnc server is running on this port.                                   
Service Detection – Unspecified Port: A Web Server is running on this port:
Service Detection – Unspecified Port: A Web Server is running on this port:
Service Detection – Unspecified Port: A Web Server is running on this port:
Apple Port Listing"
Port
TCP or UDP
Service or Protocol Name
RFC
/etc/services
Used by / Additional information
7
TCP/UDP
echo
792
echo
20
TCP
File Transport Protocol (FTP)
959
ftp-data
21
TCP
FTP control
959
ftp
22 RISK MEDIUM
TCP
Secure Shell (SSH)
4250 - 4254
ssh
23
TCP
Telnet
854
telnet
25
TCP
Simple Mail Transfer Protocol (SMTP)
5321
smtp
Mail (for sending email); MobileMe Mail (sending)
53 NO RISK
TCP/UDP
Domain Name System (DNS)
1034
domain
MacDNS, FaceTime
67
UDP
Bootstrap Protocol Server (BootP, bootps)
951
bootps
NetBoot via DHCP
68
UDP
Bootstrap Protocol Client (bootpc)
951
bootpc
NetBoot via DHCP
69
UDP
Trivial File Transfer Protocol (TFTP)
1350
tftp
79
TCP
Finger
1288
finger
80 RISK MEDIUM
TCP
Hypertext Transfer Protocol (HTTP)
2616
http
World Wide Web, MobileMe, QuickTime Installer, iTunes Store and Radio, Software Update, RAID Admin, Backup, iCal calendar publishing, iWeb, WebDAV (iDisk), Final Cut Server, AirPlay, OS X Lion Internet Restore, Profile Manager.
88
TCP
Kerberos
4120
kerberos
106 NO RISK
TCP
Password Server
(Unregistered Use)
3com-tsmux
Mac OS X Server Password Server
110
TCP
Post Office Protocol (POP3)
Authenticated Post Office Protocol (APOP)
1939
pop3
Mail (for receiving email)
111
TCP/UDP
Remote Procedure Call (RPC)
1057, 1831
sunrpc
Portmap (sunrpc)
113

Answer 1

You have to bear in mind there is no hard relationship between a protocol (e.g. 'HTTP', 'HTTPS', etc.) and port number. Any protocol/service can run on just about any port. Sure, there are conventions (HTTP -> 80, SMTP -> 25, etc.), but you are free to override those in your own configuration.
In addition, Apple's listing covers the default ports used by the various Apple-provided services and configuration, so yes, you'll find multiple 'HTTPS'-based services listed, but that's not to say they're being used because you might not enable the associated service.
For example, if you don't use JBoss then the 9006/8080/8443 ports might not be used.
So it's up to you to look at the services you're using, to determine which ports they're using, and configure the network accordingly.
If you're only running standard web services then you should only need port 80 (and 443 if you're using HTTPS), although it looks like Profile Manager also uses port 1640.