I am running SCCM 2012 R2. I am trying to install sccm clients to computers located in different remote sites through group policies,users computer have firewall on so

What services should be running at user computers?

Which ports should be open at users computers firewall, if any?

Second part of the question is I will also be pushing Windows updates to those computers

Any brief document to set up branch distribution point kind of setup in SCCM 2012, which was there in 2007

Thanks

What services should be running at user computers?

- Not sure if this is fully documented anywhere. Are you disabling services on workstations such that this is a concern?

Which ports should be open at users computers firewall, if any?

- For normal client agent operations, assuming a stateful firewall where outbound traffic is not blocked, none except for remote tools. For reference, all port requirements are listed at https://technet.microsoft.com/en-us/library/hh427328.aspx

Also note that there is no such thing as a branch distribution point in 2012. They are all just DPs and behave exactly the same (with a few minor caveats).