If NAT is configured properly, the default traffic flow policies will work. You'll configure the outside interface as security level 0 (least trusted interface) and the inside interface is typically security level 100. A DMZ will typically be somewhere in between, like 50. By default, the ASA allows traffic from more-trusted interfaces out less-trusted interfaces, and the state tracking on the ASA will allow return traffic. In this case, even though the DMZ is not a "trusted" interface, it's more trusted than the outside interface, so traffic from the DMZ will be allowed out the outside interface. (Traffic from the DMZ would NOT be allowed out the inside interface unless specifically allowed by an access list.)
For the NAT configuration, you'll want an object group that represents the DMZ subnet or host, and then configure:
object network <object-group_name>
nat (<dmz_interface_name>,<outside_interface_name>) dynamic interface
That will allow the PI server to know where to send the response without having to have a route to the DMZ subnet.
That's the very basics. There's a lot more you need to know to configure other features (management access, SNMP traps, etc.) that that should get you started.
