To my knowledge you only need to white list external sites connecting to SAS e.g. your company's intranet portal connects to the SAS web server for some info.
depending on your SAS maintenance level, yes, SAS will take care of it. In some cases, you might need o include a *.yourdomain.com/* or yourserver.yourdomain.com/*.
If your server has no access from/to internet, hence, just internal, and security policies are not really strict, you can start your deployment with a simple * in your white-list and you can filter it later on.
The SAS Users Group for Administrators (SUGA) is open to all SAS administrators and architects who install, update, manage or maintain a SAS deployment.