You can connect clients directly to your ESXi network if your environment does not include vCenter Server.
Standalone hosts receive communications through the VMware Host Client, one of the vSphere command-line interfaces, the vSphere Web Services SDK, or third-party clients. The firewall requirements for standalone hosts are similar to requirements when a vCenter Server is present.
Use a firewall to protect your ESXi layer or, depending on your configuration, your clients and the ESXi layer. This firewall provides basic protection for your network.
Licensing in this type of configuration is part of the ESXi package that you install on each of the hosts. Because licensing is resident to ESXi, a separate license server with a firewall is not required.
You can configure firewall ports using ESXCLI or using the VMware Host Client. See vSphere Single Host Management - VMware Host Client.