From the global zone, you might check the output of:
$ dladm | grep <zone-name>
$ dladm show-linkprop <zone-name>/<iface>
zonename/aggr0 allowed-ips rw 10.2.42.142 10.2.42.142 -- --
Then, you should be able to change it using:
$ dladm set-linkprop -p allowed-ips=10.x.y.z zonename/aggr0
This might do the trick, I know if you have the link-protection to allow only listed IP address, this will update the list without the need for a reboot.
NOTE: I don't have a test zone available to actually verify this, but I know I already did this once in the past and it actually worked...