You have to indeed open port to at least your EMS Cloud server public IP. You can locate your EMS public IP in the about tab at the bottom left when you login to EMS Cloud.
AD Connector can be setup for EMS Cloud as well. In fact the purpose for AD Connector is usually for EMS Cloud, but it is still very niche usage, since it increases management overhead (you will have to upgrade Connector version when EMS version is upgraded).