Depends on the capabilities of your firewall, really, but first: stop doing anything that involves being logged in on port 80! If your CMS asks for username and password, and you're running over HTTP (as would be standard for port 80), your username and password would be sent in clear text between your local machine and your server.
Once you're running over HTTPS, there is very little difference in the two approaches:
- Any misconfiguration in httpd.conf could open up loopholes, so you should be looking to minimise the chances of these. This could be through a limited set of configuration options being used, making it easier to monitor, or through keeping restrictions relating to specific sites in dedicated configuration files, again, ensuring that they can easily be checked for issues.
If your firewall can only monitor traffic on a port level, it may introduce unintended paths to access content authoring functions if the CMS has not been built with this in mind. For example, it might still be possible to access content authoring tools over the main site port, but for the content authoring port to be unable to access the main site - this would depend on the specific CMS in use.
If you have a more powerful firewall, which can do traffic inspection, you may be able to restrict access to specific URLs to given IP addresses. You may also be able to put these restrictions in place with some WAF systems. There is still a chance of misconfiguration, just as with httpd.conf though.
For most small sites, modifying httpd.conf or related files is probably sufficient. For larger sites, there is nothing to stop you from doing both - defence in depth is a good principle. For really high profile sites, you probably want to separate the content authoring and actual site serving, and implement some kind of push mechanism to send updates made on an authoring server to hosting servers which don't allow for modifications by other methods.
