Instrumentation amplifier & microcontroller ADC protection circuit
What you will likely find is that a simple resistor in series between the InAmp output and the MCU input is all that will be necessary to protect the MCU. Look up the current that can be put into the MCU input in the absolute max rating table for the MCU.
Then, you can probably run your InAmp from a +5 volt rail because, running it from 3.3 volts means the maximum level it can produce is a 150 mV short of its Vcc rail. Given that you could use a current limit resistor between InAmp and MCU input, that will offer any over-voltage protection from the InAmp.
Regards running the InAmp from a negative rail (as opposed to 0 volts) is tenuous given that the InAmp output can swing down to within 10 mV of the negative rail (or ground).
In addition, the InAmp data sheets says this about input over-voltage protection: -

Internal supply referenced clamping diodes allow the input, reference,
output, and gain terminals of the AD8223 to safely withstand
overvoltages of 0.3 V above or below the supplies. This is true for
all gains, and for power-on and power-off. This last case is
particularly important because the signal source and amplifier can be
powered separately. If the overvoltage is expected to exceed this
value, limit the current through these diodes to about 10 mA using
external current limiting resistors.

So, by careful choice of series current limiting resistors on the InAmp input, you can avoid the need for zeners.

My somewhat-rusty understanding is that R1 will limit the current
going through the first two zener diodes (D1,D2) so R2 and R3 aren't
necessary. Is that correct or am I missing something?

Answer: Missing something