Strict ingoing and outgoing restrictions to Comodo?

I'm putting up a Win8 system, where I only need 3-4 installed programs, who need to call home for communicating, licence checking, updates etc.

Also I only need to access about 2 sites with browser from that system. (Windows update needs to work too, ofc)

I use Comodo IS 6.3 (set up mostly like in Chiron's guide) in that system (and Zemana). I'm using my ISP's DNS, not Comodo's.

What kind of rules should I create in Comodo to prevent any other connections in or out?

And what about Microsoft's different svchost calls, do they need some extra consideration or rules?