You don't need to do the onboarding with OTP with a 9800-80, that will be done automatically, assuming controller is able to reach dnaservices.cisco.com. The controller will automatically try to reach the cloud through management or data port, there'...

You need to allow access to dnaservices.cisco.com port 443 and commercial.ocsp.identrust.com port 80.