>>> Thanks for your answer. Is it necessary to add them to ephemeral port?
That's not a requirement. However, in environments that I setup/configure, I always at least create an ephemeral port group for the management network to be safe in case something unexpected happens, and the vCSA's network settings need to be reconfigured from an ESXi host directly.
Better safe than sorry
André