To set the IE security zones using a GPO and still allow the user to add their own you need to set the defaults using registry keys.
You can find the registry key GPO area under User Configuration > Preferences > Windows Settings > Registry
Here’s an image of some of the entries we use
The last setting in the image above is the zone. You’ll need to know if you need to use Local Intranet Zone or Trusted zone. Here is a table to tell you which value is which zone
Value Setting
0 My Computer
1 Local Intranet Zone
2 Trusted sites Zone
3 Internet Zone
4 Restricted Sites Zone