-
The email you received with your kc.lic included some details on this topic:
Generally, kdb+ as an on-demand client behaves exactly like, and should be treated the same as, any plain http client (e.g. curl, apt-get or firefox) accessing a CDN-fronted web service.
It connects to a remote port 80 as part of a normal http request; thus you generally only need to allow outbound http _connections_ but both _traffic_ to and from remote port 80.
As the communication protocol is plain http you can employ any standard mechanism, including proxies (transparent and opaque by setting the HTTP_PROXY environment variable) as long as kdb+ is able to issue an http request and receive a response from the remote Kx service.
If you need to allowlist the remote servers should treat kdb+ on-demand as a CDN-fronted service and employ DNS-based filtering. The current list of hostnames required for kdb+ on-demand operation is {h,g}.kdbod.{com,net,org}.