PowerCLI through a firewall to 6.5 ver VCSA and PSC

Hello Community - in the (very audacious) hope of inputting my firewall change once, I'm hoping someone has experience with using PCLI through a firewall to gather data from a 6.5 VCSA.  We are running a single vcsa with embedded db, and (2) stand-alone PSCs (active|passive config).  I'm not exactly sure if I need to open ACLs into the PSCs as well as VCSA.  I am only gathering inventory data, so I shouldn't need to the ports for opening console connections, or invoking scripts on the guest virtual machines, or anything as exotic as that.

opt 1:

source: source IP of PCLI server

dest: vcsa

tcp ports: 443, 10443

opt 2:

source: source IP of PCLI server

dest: vcsa, psc1, psc2

tcp ports: 443, 10443

opt 3:

is it really something COMPLETELY different?

Thanks in advance!

Brent