I don't know how the Black Ice will do with SPS, but there are no
additional ports  to open  on your firewall. Pretty much everything is
over port 80.

Are web folders over port 80 as well?

Yes, but it used WebDav which uses extend "verbs" that the black  ice might
block. Sharepoint is a VERY sensitive product and I will not recommend
installing anything that might cause you a lot of nightmare down the road.

My experience is, that you shouldn't set black  ice to some other setting
than "trusting", when using standard settings. I'd be happy to find
somewhere the specification of most restrictive black ice  settings
possible (that won't stop sps from working)...

If sharepoint indeed only needs port 80 (and 137/138/139 for content source
indexing potentially), then I should be able to set it to paranoid and add a
rule that allows inbound port 80.

If I explicitly allow inbound port 80 from intranet addresses, then it won't
care about the verbs or anything else. It should still scan for known
malicious things like nimda, codered, etc.

Since I'm building it slowly, I'll test a couple of settings  and report back
to everyone what worked.

Reporting back.

I ran Black ice  on my test server  allowing port 80, 3389 (term
services), 161 (for snmp) and ran some stress testing on it. No
problems to report; worked like a charm.