I like using 587 for SMTP submission because it is rarely blocked by firewalls while 25 is almost always blocked.
To enable this in Zimbra, I uncommented the following lines in ~zimbra/postfix/conf/master.cf:
submission inet n - n - - smtpd
-o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes
Works great. This should probably be the default behavior.