I do not recall the app needing direct communication with the endpoints. My understanding is that it uses the AXL API on CUCM to set the activation code and initiate the onboarding. The help article seems to agree, listing only communication with CUCM in the requirements section.