Ahha, now I know what xxx is... (it is normally also used as the netiquette for "hugs and kisses" so good that we clarified that... :-))
Well, if that is the network domain for the SAP servers then you have effectively isolated the servers to be able to communicate freely amongst each but block everything else.
You must however still consider that some clients accessing the gateway might be outside of the SAP server zone. This is often the case for BEX analyzer and some 3rd party software for mass processing which should not impact the SAP server (PDF generation, mass printing queues, etc).
If the clients and other communication servers are also all in this xxx network domain, then you will be fine but do have a very pragmatic gateway ACL approach. The EWA will however not complain about it as long as the parameters are set and the files exist.
Cheers,
Julius