Well, I guess that depends on your paranoia level. If you run any peer-topeer stuff, you'll have to, of course. I usually say no, because I have Real installed and it likes to connect to it's servers without my asking it to. (good video streaming, horrible company, IMO).
The only always-connect programs I allow are ieexplorer, outlook, msn, and seti@home. Even at that, I'm not totally safe. But my paranoia only goes so far...
And I only allow server access for msn and outlook. You shouldn't need it for ie. Next time you get a window, track down what program exactly is calling for access. My rule is if I don't know what it does exactly, I deny it. Until something breaks, that is.
If you're on an always-on internet connection and keep your system running all the time, you can always set-up the Internet Lock for 10-minutes idle - that'll protect you regardless of all other allows (unless you give something pass-lock, of course).
Have I confused you? Because I'm a little confused now......
-Pif