On-boarding apps / users on ZPA

Need help / advice regarding large scale user / app on-boarding?

Assuming, the user organization has multiple applications (>100) and users in large numbers (>1000), then what would be your approach to initial user and app on-boarding, at the time of deployment?

In a traditional SSL-VPN + Firewall setup, I would first have to list down all the apps, users / user-groups and then create an access matrix based on these parameters. This is a time consuming and error-prone approach. Not to mention, the policy creation based on this would need to be in steps, making this deployment very long.

How would you do this in a ZPA environment?
Do app discovery-esque components in ZPA make this process easier?