I'm sure OP has solved the problem already, but of posterity, the following ports have to be exposed (8080 and 3478)
The rest of the ports aren't required for adoption.
What I don't show here is that my Unifi web-app portion is behind a reverse proxy (Traefik)
Additionally, you need to use option 43 in DHCP as mentioned by Patrick above.
The L3 adoption article explains option 43:
https://help.ui.com/hc/en-us/articles/204909754
To calculate what you need to put in Option 43, the following calculator works:
Making a Unifi L3 Adoption easy with DHCP Option 43 on pfSense, Mikrotik and other Routers. A small Wizzard and config Information Sheet how to add the Vendor Option 43 quickly.
tcpip.wtf
Last note, the ports above HAVE to be the ports shown there, sadly Unifi have decided those ports belong to them and changing them means you need manual intervention (ssh to the device to adopt). If you want to learn more, you can read
https://help.ui.com/hc/en-us/articles/218506997-UniFi-Network-Required-Ports-Reference
If you have other apps running on those ports, I suggest using a reverse proxy and don't expose the ports, and if you absolutely HAVE to expose those ports on another application, you'll want to use something like MetalLB.