When sending screening requests to Universal, VSys makes an outbound HTTPS connection from the machine on which the VSys scheduled task runs to Universal's server. This is the only time that VSys itself reaches out to Universal.
Status and results are returned to VSys by Universal through your VSys Live Server. The path that Universal will usually use is https://(your site)/download/universalscreen
. This does not require any special firewall handling: if you're self-hosting VSys Live, this port is open anyway as part of VSys Live itself. These statuses may be Invitation Sent, Ready for Review, or others as appropriate. VSys doesn't "understand" these statuses, but they can be used as the basis for reports, notifications, etc. All updates from Universal are logged within each background check request in the volunteer's profile.
This does mean, of course, that Universal can't be used without having VSys Live.