When you add a vApp to Catalog, the settings are inherited from the VMs/vApp you are capturing. If Guest OS Customization (GOSC) was turned off when captured, that setting will persist as is.
I find education of the user base can go a long way, but isn't always the optimal solution.
If you want absolute prevention, you have to either 1) limit the user's ability to turn on the feature (roles/rights), 2) Abstract the vCD website with your own, 3) Use blocking tasks for VM modification and just validate they did not enable GOSC on a VM.