How to Deal with 0-Days?

First, let's define the term "zero-day" based on industry experts.
"A zero-day vulnerability is a software security flaw that is known to the software vendor but doesn't have a patch in place to fix the flaw" - Norton
"A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to, or unaddressed by, those who should be interested in mitigating the vulnerability (including the vendor of the target software). ... An exploit directed at a zero-day is called a zero-day exploit, or zero-day attack." - Wikipedia
"A zero-day vulnerability, at its core, is a flaw. It is an unknown exploit in the wild that exposes a vulnerability in software or hardware and can create complicated problems well before anyone realizes something is wrong. In fact, a zero-day exploit leaves NO opportunity for detection ... at first." - FireEye
"The term “zero-day” actually refers to the number of days the software vendor has been aware of the vulnerability or its exploit" - Digital Guardian

Therefore Zero-day by its definition cannot prevented 100% of the time. The best practice is to assume that you have already been hacked. This is a very important paradigm shift to accept. If you think you have not been hacked, you are not going to be hunting for signs of intrusion. If you assume breach, then you will always be hunting for it.
Every organization then needs to balance their cybersecurity risks with the costs. Does it make sense to spend more money on 60 separate cybersecurity solutions, if that total cost exceeds the value of the asset you are trying to protect? Sadly, the average medium to large size organization does just that, they often spend money on "best of breed" security solutions that do not integrate, which ironically leads to a more vulnerable organization when it comes to zero day attacks.
Full disclosure, I am biased towards how Microsoft solves this problem because I own and operate a Microsoft Cybersecurity consulting company, so my approach towards a zero day is going to sound a bit like a Microsoft commercial. I want to say that there are lots of excellent alternatives in the marketplace, but the reason I choose to partner with Microsoft is because I personally believe that a consolidated solution is better than managing 60 separate best of breed solutions.
Microsoft Defender Advanced Threat Protection (MDATP) is an extended detection and response (XDR) solution, that combines protection for endpoints (Microsoft Defender ATP), email and productivity tools (Office 365 ATP), identity (Azure ATP), and cloud applications (Microsoft Cloud App Security/MCAS). As customers face attacks across endpoints, cloud, applications and identities, Microsoft's XDR looks across these domains to understand the entire chain of events, identifies affected assets, like users, endpoints, mailboxes, and applications, and auto-heals them back to a safe state. So while the initial execution of the zero day may go unnoticed, the next step in the kill chain should get picked up by the XDR platform.
In my opinion, Microsoft's use of virtualization technologies can greatly mitigate zero day risk. For example, Office 365 Safe Documents (https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-docs?view=o365-worldwide) and Application Guard (https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) helps to isolate enterprise-defined untrusted sites, protecting your company while your employees browse the Internet.
Ultimately, it comes down to how much risk you can accept, how valuable the asset is you are protecting, your budget, and following laws including mandatory notification. Fortunately, you don't have to reinvent the wheel. You can leverage risk frameworks like the NIST Cybersecurity Framework to get started. (https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf)
The NIST cybersecurity framework is a prioritized, flexible, repeatable, performance-based, and cost-effective approach, including information security measures and controls that
may be voluntarily adopted by owners and operators of critical infrastructure to help them
identify, assess, and manage cyber risks.
The other question you raised is "if you encourage any direct 0-days." I assume you are asking if it is recommended to detonate known threats in controlled labs to determine if the defensive controls are effective. Yes - do that often. 
If you like my response, please mark it as the best answer 😃
-Joe