To set the IE security zones using a GPO and still allow the user to add their own you need to set the defaults using registry keys. You can find the registry key GPO area under User Configuration …