The reboot is only required if you change the mirror port between layer 2 and layer 3. So if the port stays the same mode, for example a layer 3 ip address, then no reboot is needed to change which port you mirror. But if you change the mirrored port to layer 2 removing the ip address, then a reboot is needed.
There is no security zone needs on the mirror port. But security policies do apply to the original traffic on the source port.