The support tunnel works through a NAT firewall so you do not need to open ports to use it.
It only functions while it is enabled. When you turn it off there is no remote access to your device.
So as long as the 300 is not directly on the internet there is no issue.
Do you expose your e-mail gateway to the internet to permit users to see quarantine mailboxes and encrypted e-mails?