One possible use case is providing an entire LAN access to a VPN without using NAT.
But don't assume that those two addresses would automatically belong to different networks. Even in IPv4, a computer may have one or more "external" IP addresses from the same network assigned directly to it. (This is the case with most servers, for example.) This can be used to implement IP-based "virtual hosts" (with one site per IP address – not only for old SSL versions, but also for various old protocols such as FTP).
In IPv6, multiple IP addresses are very common. For example, a single interface can have
a link-local address
fe80::4a5d:ff60:e8fe:658f, which is based on the MAC address and always the same everywhere; it is used for IPv6 internal purposes (Neighbor Discovery).
a global address in your current network
2001:470:1f0b:614:4a5d:ff60:e8fe:658f, which has the same "host identifier" but might have different prefixes depending on the network; it can be used for incoming connections from other Internet hosts.
several global privacy address in the same network
2001:470:1f0b:614:a944:101:7c99:25ce (a "current" one and several "deprecated" (expired) ones), which have the same network prefix but randomly-generated host identifiers, which are changed every few hours to prevent tracking; these addresses are used for outgoing connections, such as browsing websites.
Note that it absolutely doesn't make sense to prevent the user from assigning multiple addresses. If I have sufficient privileges to add an address, I also have sufficient privileges to craft arbitrary IP packets (or even Ethernet frames) and have them sent over the wire, with any addresses I want.
In other words, if your issue is preventing users from accessing certain parts of a network, it cannot be solved on the users' machines – you should ensure that the network itself is secure (firewalls, 802.1x, port security on access-layer switches, or whatever else network guys use to achieve this).