SEPM Security zone design

I want to create a new SEPM design based on 4 different security zones. We need SEPM servers in all zones, clients are not allowed to communicate across the zones. All zones are located at the same location and just a limited number of clients (the clients are mostly servers). I'm thinking of a distributed SEPM design with Central logging. Any tips / links? Thanks.