Better is to figure out what needs to run to allow the deploy, and create a rule allowing that.
We have deployed software using both ZenWorks and Altiris with CSA, in each case it has meant creating an allow rule for one or more new application classes. The only drawback is you generally have to allow the application to run *any*.
To be more restrictive, after the rules are created and working to your satisfaction, you could enable them on demand if all of your software deploys are scheduled.