Yes, we do deploy through ZWC. The problem is that as things stand, we have no way to prevent users installing ZDC on a computer and syncing their whole mailbox.
I placed a support case on this issue and received the following info from the engineer:
"Many ISP type customers have recently raised this issue too after Z Desktop went into GA.
This feature is targetted for ZCS 6.5
Developers are working on separate COS for Z Desktop Client.
You may like to view http://bugzilla.zimbra.com/show_bug.cgi?id=18842"