You should allow the following ports for SIP
5060/udp = Normal traditional SIP
5060/tcp = SIP over TCP. May be required if headers get long due to STIR/SHAKEN requirements. Likely will need it in the future with Trunk providers not for handsets.
5061/tcp = This is used for SSL/TLS encrypted setups.
You probably do not need 5061 unless you are doing secure VoIP.
Also you will need port 80/tcp open to allow Letsencrypt to update the SSL certificates.
And you should have port 5000/tcp allowed only from a trusted source.