Zoning requires internal virtual N ports that are created by SME in the default zone. The default zone must be set to deny and these virtual N ports must not be zoned with any other host or target.
For information on zoning, refer to the Fabric Configuration Guide, Cisco DCNM for SAN and the Cisco MDS 9000 Family NX-OS Fabric Configuration Guide.