I found a way to change it from Uncheck or Checked using the Registry
Reg Key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
Value Name: Flags
Value Type: REG_DWORD
Value Data (in decimal): 67 (to uncheck) or 71 (to check)

But, how do I add that to this?

No, should not be necessary. But keep in mind, the end of support for IE is near within less than a year.

Haven`t used this for long time myself, but this should work without deploying ADMX files. But don`t just copy past the policy from the website, as WordPress screws the quotation marks. Replace them yourself. Or send me an email and I can send you an example.

Unfortunately I have no experience with managing a Surface Hub. If the CSP policy is supported, than I think you should try with Device. If that doesn`t work, remove device and try it without ./Device and without ./User like in the example in this document https://docs.microsoft.com/en-us/surface-hub/manage-settings-with-mdm-for-surface-hub#example-manage-surface-hub-settings-with-system-center-configuration-manager

Does this apply to Intnue-managed AAD Joined Surface Hubs? with the exception of ./Device instead of ./User ?

If you mean “AllowSiteToZoneAssignmentList”, no I don`t recognize this. On my testing it removes the old site and puts in the new site.