Yup this would work fine. However you could also leave only one network card on the ZS and add another IP on the interface. However your clients will be able to change their IP address and bypass the proxy. So technically the best solution is the scheme you proposed.