Host-based firewall - This is a firewall on a host where you can configured rules for ports/connections allowed on that specific host.
As the question specifically is asking for web-server ports to be blocked, it would make more sense to configure rules to block the ports on each web server.
Application allow list - A list of applications and application components that are permitted to reside or perform actions on a device SWG(Secure Web Gateway) - A security product that operates between employees and the internet by filtering unsafe content from web traffic to stop cyber threats and data breaches. They also block risky or unauthorized user behavior. SWGs usually analyses the content of traffic.
VPN (Virtual Private Network) - A service that establishes a secure encrypted connection between networks over the internet. Hosts connected on the network will behave logically as if they're on the same network even if they are a physically not.