can someone please clarify the external network usage for me?
I need to attach a VM managed by VCD to a network outside of VCD. My understanding is that I need to bring this network into VCD as "external network" and then add it to the Org as "direct network"? Is that the only option?
If I add the external network to the Org, how can I prevent the Org Admin from attaching more VMs to this network that's now visible in their Org?
You are right, the provider needs to onboard the external network. There are RBAC roles available in VCD, you can create the roles with view permissions or completely deny org network visibility.