Enable and manage the macOS firewall with a Configuration Profile. NB: See comments for important info!

EnableFirewall.mobileconfig

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>Applications</key>
			<array>
				<dict>
					<key>Allowed</key>
					<true/>
					<key>BundleID</key>
					<string>com.apple.RemoteDesktop</string>
				</dict>
			</array>
			<key>BlockAllIncoming</key>
			<false/>
			<key>EnableFirewall</key>
			<true/>
			<key>EnableStealthMode</key>
			<true/>
			<key>PayloadDescription</key>
			<string></string>
			<key>PayloadDisplayName</key>
			<string>Firewall</string>
			<key>PayloadEnabled</key>
			<true/>
			<key>PayloadIdentifier</key>
			<string>6FAAAE1C-9A04-47F7-B274-151DB77B58FE</string>
			<key>PayloadOrganization</key>
			<string>YOUR ORG</string>
			<key>PayloadType</key>
			<string>com.apple.security.firewall</string>
			<key>PayloadUUID</key>
			<string>6FAAAE1C-9A04-47F7-B274-151DB77B58FE</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
	</array>
	<key>PayloadDescription</key>
	<string></string>
	<key>PayloadDisplayName</key>
	<string>Enable Firewall</string>
	<key>PayloadEnabled</key>
	<true/>
	<key>PayloadIdentifier</key>
	<string>39E7E3BB-F5E4-4AD0-97DD-9FB503BD5DE3</string>
	<key>PayloadOrganization</key>
	<string>YOUR ORG</string>
	<key>PayloadRemovalDisallowed</key>
	<true/>
	<key>PayloadScope</key>
	<string>System</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>39E7E3BB-F5E4-4AD0-97DD-9FB503BD5DE3</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
</dict>
</plist>

Edit the YOUR ORG placeholders as appropriate, as well as any description and display name keys.

If deploying from a Jamf Pro Server, you should definitely sign this profile before uploading it to ensure its contents are not modified. If left unsigned, the JPS may modify the profile to where it disables the firewall instead of enabling it 😱

In case you didn't know the PayloadUUID and PayloadIdentifier key values are unimportant, but should be globally unique. You can use uuidgen in a Terminal to generate new UUIDs if you want.