Billing of Mac devices also takes place when the device is turned off. A device in a stopped state continues to reserve the dedicated Mac device and therefore charges incur until you delete it.
For security reasons, only two TCP ports are open from the outside. These are ports 5900 (VNC) and 22 (SSH). The port settings can be restricted or extended in the Control Panel via Mac Bare Metal > Networking > Security Groups > Default.