Like most such solutions, the Barracuda Antispam offers directory lookup (LDAP/LDAPS), SMTP "look-ahead" where each recipient is validated on the next SMTP hop before being accepted, and a manual recipient list -- see Solution #00003521. Only the directory lookup approach requires an additional port, you would need to permit LDAP/LDAPS (389/636) or more commonly the GC ports (3268/3269) from the Barracuda to a suitable AD server.
Domains > manage domain > Users > LDAP Configuration
You can configure a low-privilege AD user which only needs search access to user email attributes in your AD tree (then enable it for the domain on the Barracuda under the ''Valid Recipients'' tab). Assuming you do not permit anonymous search access to your directory (not recommended), you should use a dedicated search user and LDAPS, this will require a certificate on the AD server.
SMTP look-ahead only works if the next hop is able to authoritatively answer, i.e. it must reject invalid recipients (with an SMTP 550) or it will not be effective. You may need to configure it to do that (some SMTP servers inexplicably default to accepting anything, then generating a bounce for invalid recipients). Look ahead is implicitly enabled if LDAP is not used. If you're using MS-Exchange, this is quite likely what's preventing the default look-ahead from being effective, look at this approach first.
Otherwise, using LDAP is the next best approach, though not without some risk since you're allowing a device which accepts untrusted connections from the internet establish connections to your AD. More paranoid alternatives are an LDAP proxy in a DMZ (reasonably straightforward with OpenLDAP as a proxy); or a filtered replica in a DMZ (I believe this may not be easy to do with AD, though it's easy in a OpenLDAP environment).
(Also, if you're not using it already, try the Barracuda RBL, it's very effective at blocking unwanted connections, though expect a low number of false positives).