The built-in Web Server running on port 80/443 (default) needs to be accessible externally.
Application Workspace also supports direct access to get content directly from the Azure Blob storage. In case your Application Workspace System is hosted on Recast Software's cloud infrastructure and you configured an on-premise Application Workspace Satellite Server you need to configure the firewall to allow the content URIs. To see the URIs, navigate to User Portal > Device > Content Access.