I've seen some need to permit access to Kibana, but not open up access to Elasticsearch's API (tcp/9200) directly. For this, and when you're using the elasticsearch-py Python Library, you can use the following transport in order to connect through your available Kibana instance, through to the underlying Elasticsearch nodes.
Kibana Proxy Transport for Elasticsearch for Python
Kibana Proxy Transport for Elasticsearch for Python - KibanaElasticTransport.py
262588213843476