To improve the detection rate, you can send suspicious files to Sophos for investigation. This can be done either via a web interface or by email. More information can be found at https://community.sophos.com/kb/en-us/11490
An RPC-based protocol is used to communicate between Enterprise Console and the client on which Sophos is installed. Since additional ports are required for communication, it is easiest not to block any ports between Enterprise Console and the client.