On-premise Log Collecter needs public IP?

I'm following the instructions https://docs.microsoft.com/en-us/cloud-app-security/discovery-docker-windows to setup an on-premise log collector to send firewall logs to MCAS for Cloud Discovery.  When configuring the log collector within MCAS, it asks for "the Host IP address of the machine you'll use to deploy the Docker".  Does this need to be a publicly accessible IP?  The network requirements https://docs.microsoft.com/en-us/cloud-app-security/network-requirements#log-collector only refer to communication initiated from the log collector to MCAS, but if MCAS is asking for the IP of the log collector, that would imply (to me at least) that MCAS would be initiating traffic to the log collector.  Any clarification here would be greatly appreciated.