Hi Tom,
Well, you could install Adminer:
http://docs.moodle.org/27/en/Adminer
and use it to update (via SQL update statement) the maildisplay field.
Then create a role with the Update own profile capability disabled:
http://docs.moodle.org/27/en/Capabilities/moodle/user:editownprofile
and assign it to the users who musn't change their profile.
http://docs.moodle.org/27/en/Roles_and_permissions
---
http://docs.moodle.org/27/en/External_database_authentication