You don't need to "open any ports" to the ESX servers to allow them to synchronise time. You also don't need to synchronise time with an external source. What's more important is that they synchronise to the same source as the rest of your internal network. An internal router is a common source for smaller setups.
(If you'll be putting your domain controllers on ESX and want to sync ESX with the same source as the rest of your network, it might be a good idea to leave the PDC emulator role on a separate physical machine for timekeeping reasons - don't synchronise ESX with a VM!)
You'd do well to read through the following paper: http://www.vmware.com/pdf/vmware_timekeeping.pdf
It's also a good idea to disable the Windows Time service on your VMs if you synchronise your VMs clocks with ESX (which, in my opinion, is a good practice.) Two conflicting time synchronisation methods are not a good idea.