How to best deploy default security zones without forcing using IEAK or GPO with IE 11

We are planning to upgrade to IE 11 firm wide and I am looking for the best option to deploy a default set of "Intranet sites" and "Trusted Sites" to all staff.  I can do this using IEAK, but it appears that GPO preferences are starting to become a preferred option.  Is there a way to use GPO preference to deploy a default set of Intranet and Trusted sites and allow staff to add additional sites to each as needed to their own Intranet/Trusted sites in IE?

Thanks
Lyle