If you update DNS, that would use DNS-01 challenge and you don’t need port 80 open. I am using this challenge type to generate certs for completely internal services. The only reason to have 80 open would be to use HTTP-01 challenge, which requires your server to host a file on a specific url only via port 80. If your service is already public on 443, you could leave port 80 open with a simple http-to-https redirect.

Port 443 would need to be open if you want to use TLS-ALPN-01 challenge, but I would avoid this as it is not easy to use or configure.

My advice for internal services is to setup only DNS-01 challenge and configure your dns to be automatically updated using a dns plug-in. This should almost never fail validation.