If you look in the distribution point, there is a file in the root called mrinit.conf. This is the file that is copied to the client at install time to configure where the Sophos Message Router service should point to.
So the server being managed will need to be able to connect to at least one of the ParentAddress values (it tries each in order) in that file on ports 8192 and 8194 TCP.