The zones in the FDM GUI for Access Control Policy add to what in the ASA configuration links an ACL with an interface.
Look at your ASA cli config for the command "access-group". That links a given ACL with an interface, usually on the "in" direction - i.e, as an inbound ACL. In Firepower we define both a source and destination zone and assign interfaces (or interface groups) to zones.
Also, in Firepower there is no concept of security levels. Instead all traffic is allowed unless explicitly denied. That's why we usually add a default rule of block all traffic - as an explicit deny.
