Seems like a flawed design, by default firewall should allow either implicit deny or accept and if we have set the property as reject for in/out traffic then except the policies required for internal working of Proxmox, rest all should work
proxmox documentation says
Datacenter...