Hi Damonbrown,
What used to be the "self service portal" is now just the vCAC appliance UI + IaaS web pages provided by the "regular" vCAC 5.2 interfaces.
so no need for a self service portal install..
also, regarding the firewall - As far as I know users have to access the vCAC VA, IaaS server , and SSO, each for its own functions, I don't believe theres a way to avoid this.