I do not believe the server is available during an upgrade installation but during the routine maintenance e.g. workflow purge, DataStore Garbage Collection, ..etc Ideally you should not let any access. You can block access via dispatcher.
Can you clarify the following:1. the same username is used when bypassing dispatcher i.e. using IP and port number2. you are able to see the full repository tree when using IP and port number
From what you said it seems that it might be blocked at dispatcher ... I don't think you need to enable it just check the dispatcher config file to ensure its not blocked. You may have an entry similar to this that block access to CRX and CRXDE Light using filter rule: /ruleLabel{/glob "* /crx*"/typ...