Nextcloud serves as a “Web-Service”:
If not changed from your side (or proxied through e.g. NGINX) then port 80 for http, port 443 for https and as well port 22 for ssh (please change if port 22 is still in use for SSH!) are used.
Inbound 80,443, (22)
Outbound: ANY
That is sufficient from Nextcloud perspective.
Cheers, Carsten