If implementing SIP, I know UDP 5060 has to be open but does the media ports for RTP have to be opened as well for DTMF to work
Yes, and for voice to work.
So SIP UDP 5060 is just for the service the media portion is the RTP correct? normally 10000 to 20000
I would highly recommend IETF publication RFC2833\4733. This document explains just about everything you need to know about transmitting DTMF inband or out of band.
This guy explains it and many other SIP topics very well.
https://andrewjprokop.wordpress.com/2013/09/27/dtmf-and-rfc-2833-4733/