tCell agents connect to the tCell cloud on two domains, api.tcell.io and input.tcell.io. Both must be accessible on port 443 for the agent to operate correctly. If your firewall blocks outbound connections to the internet, you'll need to make exceptions for tCell traffic.
Optionally, you may also want to allow connections to the tCell admin console from your datacenter hosts. The admin console is hosted on <company_name>.tcell.io, also on port 443.