How to protect open ports for Services/Programs needed for network connectivity?

I’ve noticed a number of Windows services required for network connectivity maintain open ports.

What can be done to ensure Service functionality without allowing the always-open ports to act as a network liability (i.e. hacking vulnerability)?

As an example: RPC (Remote Procedure Call) maintains multiple instances of open ports.

Also, could someone provide a link that would let me ‘prune’ all services that are constantly ‘listening’ to the network yet that don’t ever, or very rarely, provide functionality to the OS on a network level?