If your requirement is to provide security to your SAP servers without having to make any changes to the physical network or firewall devices the best option is to use NSX with Micro Segmentation.
With NSX you don't need to create separate Zone for your SAP servers to provide the required security.
The SAP servers can be part of the existing Zone or Network & the required security can be provided in more granular way which the Physical or traditional firewall does not provide.
