Microsoft Defender - Microsoft Defender Antivirus security intelligence and product updates
Microsoft Defender - Configure and validate Microsoft Defender Antivirus network connections
Microsoft Defender - Manage the sources for Microsoft Defender Antivirus protection updates
Microsoft Defender - Deploy, manage, and report on Microsoft Defender Antivirus
Microsoft Defender - Configure Microsoft Defender Antivirus on a remote desktop or virtual desktop infrastructure environment
Allowing access to the following URLs in the firewall, in addition to the License Activation URLs, and the Windows Update URLs seems to be enough to allow (a heavily outdated) Defender Antivirus to update it's Security Intelligence definition patterns:
crl.microsoft.com ctldl.windowsupdate.com definitionupdates.microsoft.com download.windowsupdate.com fe3cr.delivery.mp.microsoft.com go.microsoft.com www.microsoft.com
Source:Microsoft Defender - Configure and validate Microsoft Defender Antivirus network connections