so those ports are for incoming requests. Your SMTP requests to Sendgrid are outgoing. You won’t see a port open listening for connections for those.
roots.io uses Mailgun on port 587 and we didn’t need to do anything for security.
I suggest trying to connect manually via Telnet on your server to try and see if it really can’t connect.