Network architecture/firewall question for Dameware Central Server

Hi everyone, I'm new to Dameware and trying to setup access for a secure production environment but need some help as the documentation is quite clear to me.

I have a Server VLAN with DCS installed, a User VLAN that will have my remote support team, and a Production VLAN that is tightly locked down with the Mini Remote Controls installed.  There is no need for Internet Proxy.

I know that production and user workstations need to talk on TCP 6133 for the DCS components, and that the MRC connection is over 6129.  What is not clear to me is if the DCS is just brokering the connection and I need to have 6129 open between the entire User VLAN and production VLAN, or if DCS hosts the MRC session and I just need 6129 open between the Dameware server and the Production VLAN.

Thanks for any guidance!

Kearl