Hi Nick,
Great question! When you first create the portal zone this is giving you the space on your navigation that is for Admin reference only.
Then you are creating an app within this portal zone - this is ultimately what people are logging in to access the App in the Portal. When in the portal you have other options that you do not have within your Internal workspace an the login flow is different.
There is a video at the bottom of
this page that I try explain this a bit more.