Here are the official Domain Requirements for ArcGIS Online. These can be used as general guidelines for what addresses need to be whitelisted. It really depends on what is being used in the application. If it uses, for example, basemaps, then https://*.arcgisonline.com needs to be whitelisted as basemaps typically come from the following address:
If the application also uses feature services, then you will also have to whitelist https://*.arcgis.com as they typically come from an address that looks like this:
In terms of limiting based on IP addresses, this is not really possible as many ArcGIS Online systems do not utilize static IP addresses at this time (as outlined in the document).
In terms of ports, its all http or https traffic, which equates to ports 80 and 443.