If I understand you correctly, thus is easy ( built in feature of VCD). You can set the guest customization section of a VM before adding to catalog. This section has an option to create a random password. This password will only be shown in the vcd interface, and is random for each deployment of the VM.
A couple settings that sometimes get people with this - 1: guest customization had to be setup on the vcd cells, this is part if the install guide but sometimes missed; 2: when adding the gold image to catalog you need to pick the customize option - otherwise it will come out if the catalog how it went in.
Hope this gets you started.