Firewalls ports for FortiManager connection

Hi all,

I would like to configure  ACL for FortiGate and FortiManager connection. The devices are deployed in a closed network and FortiManager is acting as Local FDS FortiGuard server.

For licensing update , FortiGate will get update from FortiManager. As per the document , we need to allow TCP/443 and TCP/8890 for FortiGuard override service.

I'm confused what incoming and outing ports means by the document 

FortiGate to FortiManager ( Is it incoming port?)

FortiManager to FortiGate ( Is it Outgoing port?)

https://docs.fortinet.com/document/fortimanager/7.2.0/fortimanager-ports/465971/incoming-ports

As per the document , TCP 8890 need to allow for incoming ports . Does that means  from FortiGate to FortiManager IP?

Or is it 443 and 8890 need to allow for both direction  : FG > FMG and FMG > FG ?

Please help me, thank you