There is no such thing as Master-client connection going thorugh only media server.
Master <-> client comms needs port 1556 open in both directions between master and client as well as forward and reverse name lookup.
Master <-> client comms is required for any policy that has ALL_LOCAL_DRIVES in Backup Selection as well as for any user/client initiated backup or restore, including database backups and restores.
If you will be performing VMware backups ONLY, it may be possible to only have media server (backup host) <-> client comms.
Related docs:
NetBackup Logging Reference Guide (for process flow diagrams)
NetBackup Network Ports Reference Guide
https://www.veritas.com/community/blogs/nuts-and-bolts-netbackup-vmware-transport-methods-and-tcp-ports