Players make outbound connections only. Nothing needs to be opened up to reach them, and you can run as many as you like behind one public IP.
What they do need is a route out to a specific set of hostnames, a working clock, and, on a restricted network, an allowlist that covers both.