The Agent/LEM doesn't block the agent ports. With nmap ports can respond closed if nothing was listening at the time:
closed
A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it. They can be helpful in showing that a host is up on an IP address (host discovery, or ping scanning), and as part of OS detection. Because closed ports are reachable, it may be worth scanning later in case some open up. Administrators may want to consider blocking such ports with a firewall. Then they would appear in the filtered state, discussed next.
Source: Port Scanning Basics | Nmap Network Scanning
I usually use netstat to confirm the ports are open: netstat -an | findstr 3789* (if I remember correctly). This will show listening ports on a working agent.
LEM documentation doesn't focus on checking ports prior to the agent being installed, but you can find more information here:
Troubleshoot LEM agent connections, 64-bit - SolarWinds Worldwide, LLC. Help and Support