You will need to reverse 1 and 2. You need to create the zone before you can assign the subinterface to it. Other than that, you would need to change your MIP policy from untrust to (new zone).
Also, it is just "set interface bgroup0.1 zone vlan1". You don't need the tag unless you need to change the vlan ID.