Under MAC OS you have the following options for Host Checker checking:
So I think process checking would be useful here. Just just need to check which processess are running VM service, but that wouldn't be so hard I guess.
And you can put rule like this:
Host Checker Policy - rule type: process: rule name > Process name (for example /usr/lib/vmware/bin/vmware-vmx) - ACTION: DENY!
You than enable this host checker rule checking on realm or on role, depending what is your configuration / role assignment.
Haven't played with this, since I don't have Mac.