You should block all the ports that are not used. You should also restrict Internet access to all ports that are used by internal services. Use a vulnerability scanner to establish priorities. Learn how to use Acunetix to get information about ports.