I’m going to get a bad rep for advising WmRoot services, so let me qualify by saying these should be used cautiously and sparingly.
That said, the services you want are wm.server.net.listeners:disableListener and wm.server.net.listeners.enableListener.
Create two flow services to be used by your scheduler.
In Flow1, put the disableListener service. Set the input listenerKey to be the port you want to disable. This will be something like FTPListener@9021 or HTTPListener@8080. (You can check the record names in the port.cnf for the exact key.) Set the input pkg to be whatever package is associated with the port under Security -> Ports.
In Flow2, put the enableListener service. Set the inputs as above.
Schedule Flow1 when you want the port to come down.
Schedule Flow2 when you want the port to come up.