Active Workspace is the ONLY zero-install option. All others require some level of installation on the client, including the shared deployment method, which I personally avoid. For now, I've batch scripted the TEM silent installation and run this, as administrator, on each client that needs the software.
Between the two - no. But other ports that need to be opened in the firewall - certainly. There are lots of ports to think about and allow through the firewall.