Meines Erachtens mußt du nur den Socket starten. Bei mir sehen die Units wie folgt aus:
~ # systemctl cat check_mk.socket
# /etc/systemd/system/check_mk.socket
# systemd socket definition file
[Unit]
Description=Check_MK Agent Socket
[Socket]
ListenStream=6556
Accept=true
[Install]
WantedBy=sockets.target
# /etc/systemd/system/check_mk.socket.d/10-ipacl.conf
[Socket]
IPAddressDeny=any
IPAddressAllow=11.22.33.44
~ # systemctl cat check_mk@.service
# /etc/systemd/system/check_mk@.service
# systemd service definition file
[Unit]
Description=Check_MK
[Service]
ExecStart=/usr/bin/check_mk_agent
Type=forking
User=root
Group=root