It can do based on Applications(Port number) but not based on Zone or User group. FBF will be applied to Interface where you want to do forwarding so matching interface in filter is not needed. But firewall filter does provide Interface as term to choose. IP address, Protocol, Port, IP options, TCP flags, DSCP are the various filters to match when using firewall filter. You can goto firewall filter and hit ? to get various possible fields to match with.