I have not looked at an API method to restrict this (though I am almost cetain it does not exist). From a GUI perspective there is no way to grant VM Remote Console access but deny the useres from mounting ISO files on their local machines. No combination of share permissions or customized roles exists to accomplish this aside from denying Remote Console access all together.
There is no straight forward way probably to achieve this. You can delete the CD/DVD device from the virtual machine using vCenter. Then the user connecting to remote console won't be able to mount local iso files.