You should not worry about the source being Any. It is the common way for public server side protocols like FTP or HTTPS. Simply you should ensure that only the expected server(s) is (are) reachable on their open ports.
But FTP is an old protocol that was invented when firewalls and encryption were not used. It uses one TCP connection for the command stream, and a distinct one per file transfer. In the sendport mode, the data connection is initiated by the server form a well-known port (20 for FTP, 989 for implicit FTPS). That means that is is nice for your own firewall, but will cause headaches to your partners firewall admins: they will have to open input connection on their firewall to random ports...
The passive mode in a little more client firewall friendly, because the client will open the data connection. But only a little more, because the server will listen on a (quasi) random port and no longer on a well known one. And the nightmare is for the server side firewall: a legitimate connection coming from a random port and reaching a random port! In non encrypted FTP mode, the firewall was spying on the command connection to know the data ports, but no way if the command channel is encrypted...
This is one of the reason why FTPS is only seldom used, despite being a very robust protocol.