> Z3s under their own subgroup in dashboard
Not really.
You could consider prefix their network names with something like "z3-". Then you could just type "z3-" into the search and see them all together as one.
> Configuration template but then VPN mode isn't available...
>z3s have their own static ip configuration which wouldnt work in that way either.
Devices part of a template can absolutely use AutoVPN.
When you add them to a template their LAN IP addressing would be lost, but you can go straight back in and change it back to what you want.