Standard HTTPS port 443 (TCP) is used for the update check. You would also need to allow DNS queries. Of course if you allow DNS and TCP 443 from the
Blue Iris machine's IP, then you're certainly allowing a lot more than just Blue Iris update checks. It would not surprise me if the majority of Windows's telemetry, updates, etc, also operate with TCP 443.