Yes, port 8883 is used for SZ to communicate with SCI. This is because the communication protocol used is MQTT and port 8883 is the official port for MQTT over SSL and is registered with IANA (http://www.iana.org).
Port 8443 is typically reserved for HTTP and thus we are not using it for MQTT.
For firewall rules, traffic is outbound from SZ to SCI. Sorry, the documentation is not clear. The 8443 is for SZ 3.4 and below where the API is HTTPS based. SZ 3.5 and above will be using port 8883.