Locally create 3V3 from 5V for small load and uP GPIO
The voltage after the zener will be very variable with current so you won't get anything like 20mA (which might be a good thing for LED life depending on the copper attached to LED, but by design is better) and one LED brightness will likely drop significantly if the second LED comes on.
It's not entirely clear from the zener datasheet even what the typical variation will be. Figure 8 in the zener datasheet seems to assume Izt of about 2mA rather than the 50uA stated. Making some guesses maybe the dynamic resistance is in the 50 ohm range at 20mA (the highest current shown, a bit ominously for your 20mA application), which is in the same range as one of your LED series resistors.

There are many small LDO regulators that would provide more predictable performance than the zener if you chose to go that way. They would need at least an output capacitor (for stability from oscillation) and maybe an input capacitor, so the parts count would be similar.
Note: If the MCU power is off, the current through your 10K pullup resistors will get diverted so the MOSFET gates will be pulled down to about 0.7V above MCU Vdd (via the protection network in the MCU) unless the MCU has an input structure that allows inputs above Vdd (perhaps 5V tolerant inputs- but then you would not need this circuit at all!) so the LEDs will probably turn on partially (or the MCU will get powered partially and may not reset adequately).
Also the MOSFETs are not specified with -3.3V drive (and they'll get even less as that zener drops more and more voltage).
This is &quot;just&quot; an LED drive circuit so if it puts out 1/4 the LED current and the brightness varies with the number of LEDs it won't likely be the end of the world, but the MCU without power is a significant issue.
Maybe something like this (x2):



simulate this circuit &ndash; Schematic created using CircuitLab
You can eliminate the p-channel MOSFET if you reduce the LED current to something reasonable like 8mA:
The parallel 10K is because the LED drops some voltage, but there's enough for the 2N7000 gate, eventually.



simulate this circuit
Edit: As far as the GPIO limits you'd have to consult the MCU datasheet and schematic of the board to be sure. Here's a typical Cortex A7 datasheet from NXP with GPIO parameters, and they are as I expected:

Since you are told not to exceed the Vdd (which could be 0V with power off) by more than 300mV, there is a diode protection network internal to the chip from the input to Vdd (in order to protect the gate oxide at the input from ESD).
If you violate that rule by applying more a few hundred mV with power off, then current will flow from the input to the Vdd rail. This is not a proper mode of operation and other side effects may occur, including permanent damage to the chip, if there is enough current available.