Someone gave this interesting tidbit, though it was useful enough to post here. I added it to the FAQ here:
http://rhq-project.org/display/JOPR2/FAQ#FAQ-HowdoIrestrictwhichagentsareall...
Using Tomcat values in the Jboss/Remoting servlet configuration, you can restrict where your agents are allowed to connect from.
rhq-users@lists.fedorahosted.org