Tenants Networks Vmware

Hello,

We are using vmware providers and tenants for our customers. We are using one distributed switch across our clusters and each customer has there own distributed port group with a vlan attached so we can segragate the traffic at a physical level.

I understand how we can limit access to just there vms and datastores etc but i cannot see how i can stop one customer choosing another customers network during provisioning a new vm?

Am i looking at this wrong?