tl;dr -- Use ZAP to find the username and password parameters, and then Hydra with the -u switch to brute force logins, iterating through users instead of passwords as you asked.
EDIT: you can also use Burp Intruder using Cluster Bomb to cycle through. Works pretty well but not quite as fast as Hydra if memory serves correctly. There may be a similar feature in ZAP but I'm not as familiar. See the last
Attack Type on Burp's site here.
I would use THC Hydra with the '-u' switch. The tool is very simple and accomplishes what you're looking at by default. It comes pre-installed on Kali, and you can install the package on most Unix-based systems.
From the Hydra man page, the -u switch will "loop around users, not passwords". This will try pass01 for all 200 users before trying pass02 for each user. Here is a sample of what your command should look like:
hydra www.target-url.com http-form-post -L usernames.txt -P passwords.txt "/path/to/login:username=^USER^&password=^PASS^:Incorrect Login" -u -V -o hydra_output.txt
Breakdown: "hydra" is the name of the program. "www.target-url.com" is the address of the target, but you can alternatively use an IP (and specify a port). "Http-form-post" is the service you are trying to brute force. "-L" and "-P" are pretty self-explanatory, they are your login username and password files.
The next portion in the double quotes has 3 parameters you can capture with the ZAP proxy or by viewing the source code, and they are separated by the ":". First is the path, followed by a colon and the username and password parameters identified by ZAP (I like Burp, but ZAP will do the trick). Hydra will replace the "^USER^" and "^PASS^" strings with the values from your user/pass files.
Finally, the -u, as said before, will iterate through usernames, rather than passwords. "-V" will show you every password guess in stdout so you can verify it's working as it should, and -o will output the successful password guesses to the hydra_output.txt file.
I hope this helped. I am not super familiar with ZAP, but the free edition of Burp Suite is a counterpart product as far as I know, and Burp Intruder should have the functionality you desire if you must use a proxy.