Enterprise Vault HTTP Only Client

yup! thats all, if you were to use the full client it would use RPC and those ports cover a huge range of ports, so you would have to set a GPO restricting the ports and make sure that the EV Servers also are restricted as well, theres a technote for that.

But yeah, http only literally means every command that reports back to the EV Server, whether its retrieving, restoring, manually archiving, vault cache syncs etc goes through HTTP requests and it needs to communicate via port 80.

But really nothing should need to be opened on the end users desktops unless you restrict browsing capabilities for their browsers as well, and it only needs to be outgoing, the only time EV will communicate with an end users desktop is if you are doing a server driven PST Locate and Collection process

One thing you may want to check though is what ports BITS (Background Intelligent Transfer Services) use, as when you use Vault Cache, it will download the pre-built DB files for the cache from the server via this, however many companies use BITS for windows update as well, so it may not be of concern either