Having access control based purely on IP addresses might not be such a good solution when you're having connections from SaaS cloud services. I don't think there's a guarantee that the IP that your connections have now might not be used by someone else later. And the IP address can also change, so they would need to whitelist big address spaces.
Could you please ask the other party to remove the firewall temporarily so that you can test if it explains the issue.
The public IP address of connections originating from the UAT system can change - that would explain why it stopped working.
If you haven't changed your code, the issue can't be in your code.
And since we know that D365 can make web service calls, it's not very likely that the issue is in D365.
If you're going to base the access control on IP addresses, the minimum requirement is that you can somehow automate updating the firewall rules whenever the D365 system IP address changes (which could happen during system restart, update, code deployment...).