No you don't
The Cloud Gateway makes an outbound connection over https to the cloud-hosted gateway service.
You don't need to open any ingress ports, you just need to allow your splunk instance to access the internet via https.
This page has a diagram:
The Splunk instance connects outbound over port 443, and then uses the established socket for all the traffic.
Specifically the host it connects to is
If my comment helps, please give it a thumbs up!