Any exception to the firewall policy requires supporting documentation. IT may just be covering their own ass/literally doing their job properly when they ask for the justification.
As a manager, I've noticed people tend to overthink the "business justification" field on forms and get themselves all worked up that they are being told no because they know what to put, but in reality all you normally need to do is string together a handful of words that vaguely makes sense to the person processing the request so they can check a box.
