Enable co-management and workloads

Question

Dear All,

We have a client environment where co-management is enabled already. Workloads are defined like in Pilot testing with Device configuration, resource access policies, and resource access policies.

Query - Suppose we want to do security update enablement for internet devices from Intune when co-managed? Would there be any ports requirement needs to be opened for co-management thing?

From the Intune perspective, do we need to do any settings or just enabling it using cloud attach is sufficient since we can see all devices are into Intune as automatic enrollment is enabled?

Basically, how devices can be co-managed. Please share the best practices here.

Thanks in advance.