Firewall Policy to allow communication between domain and Media Server

We have Media Computers to display streaming content on Display Screens. We allow remote access to the media computers only through the Media Management Server. We should not allow any other PC or Servers to access the Media server.

We have SEPM to manage the Servers and SEPM to manage the workstation.

We hve recently installed Symantec EP client on Media PC. 

1. we need to access the Media PC only from Management Server ( say IP: 10.10.10.1) and Media PC ( 10. 20.10.1)

what Firewall policy should we create to allow the communication between the Media Server and Media PC?

2. Should we create Firewall policy from Server -side SEPM or Client-side SEPM?

Please guide