This is from the configuration guide for IOS 15.2T. The feature is called RA guard. Basically you create a policy and define if the port that this will applied to leads to a host or to a router. Then you can be more specific and match on hop limit, managed-config-flag and match on an ACL with a range where the trusted sources should come from. You can also make the port trusted and not do any further checks.
In some ways this is very similar to DHCP snooping. The basic steps are:
ipv6 nd raguard policy RA-PROTECT
ipv6 nd raguard attach-policy RA-PROTECT
Then you can use this command to verify:
show ipv6 nd raguard policy
If your switches supports the feature then it makes sense to catch the RAs as early as possible. I don't think it's being to paranoid. The same could be said for DHCP. Sometimes it's not even malicious users, it's just a case of people not knowing better or connecting crappy devices to the network.