VMware Cloud Director Tenants automatically promotes as "Sub-Provider"
VMware Cloud Director 10.6.x
Unpublish the Role that has right: "Administer and traverse into other organizations" for the Tenant.
Unpublish the "Sub-Provider Administrator" Global Role, which by default includes the following permission: "Administer and access other organizations."
Reference Link to Unpublish the Global Role: Publish or Unpublish a Global Tenant Role to Your VMware Cloud Director
"Sub-Provider" is new feature in 10.6.x.
Reference: VMware Cloud Directorâ„¢ Sub-Provider and Tenant Guide