Assuming xx.xx.xx.xx is the IP address of your appliance.
For IP xx.xx.xx.xx allow ports 80, 443, 2200-2250,22, UDP 123 to have access to IP’s:
8.8.8.8
27.111.214.77
68.169.200.209
207.223.32.251
88.84.155.190
8.34.181.199/32
8.34.176.0/24
47.19.105.0/24
162.244.87.51
162.244.85.60
162.244.87.37/32 port5044
162.244.87.38/32 port5044
162.244.87.0/24 port 443 and port 80
198.49.95.0/24
198.137.225.0/24 port 80 and port 2200-2250
198.137.226.0/24
206.201.136.0/24 port 80
206.201.137.0/24
27.111.249.0/24
162.244.87.109
23.202.72.84
8.34.181.249
198.135.233.13
91.189.88.0 through 91.189.95.255
8.34.165.0/24
8.34.181.0/24
192.30.37.0/24
198.49.95.0/24
162.244.84.0/24
162.244.85.0/24
206.201.139.0/24
70.33.207.240/28
70.33.207.241/28
70.33.242.128/25
198.137.227.0/24
206.201.134.0/24
176.74.168.192/26
66.155.20.0/24
185.217.56.0/24
185.217.58.0/24
198.137.225.0/24
185.217.57.0/24
185.217.59.0/24
27.111.249.128/25
103.109.129.0/24
198.137.226.0/24
103.109.128.0/24
Also allow xx.xx.xx.xx to resolve DNS to 8.8.8.8.
And to allow the communication between the Datto appliance and the servers that will be backed up, request the following:
Between IP xx.xx.xx.xx and the whole vlan (or specific IPs), open TCP ports: 25566, 25568, 3260, 3262, 3389, 139, 445. This rule should be bidirectional, because source could be either way.