selective blocking of 4643 and 8443 on hwnode or sve

[cah4i]

I'm having PCI compliancy issues with Plesk and the Virtuozzo Control Panel. On my hosted node, I have 12 ips. Is there any reason that on either the HW node or on the Service container access to ports 4643/8443 can be blocked for the selected IPs I'm trying get compliancy for? I would then access Plesk and Virtuozzo via one of my unblocked IPs. I'm thinking something like

iptables -t filter -I FORWARD 1 -d 1.2.3.4 -p tcp -m multiport --dport 4643,8443 -j DROP on the SVE or HWnode is all that is needed.

My provider who would have to implement these rules is claiming that this will not work but I don't see why not. Is this baloney or not?

Thanks!