Don't give them the ability to do so? vCloud Director doesn't have the ability to check inside the Guest OS.
You might be able to do some post provision compliance check, but if they have access to the OS and the permissions to set an IP address ... there is technically nothing stopping them from setting the IP Address to something other than what vCloud Director provisioned.
The alternative is to not give them Public IPs from an External Network. If they are using an internal Organization Level Network, which is properly isolated via a Network Pool, then there should be no issue with the changed IP because they are separated via the Network Pools method (VXLAN, vLAN, etc).