The example from the documentation is:
vlc --ttl 12 -vvv --color -I telnet --telnet-password videolan --rtsp-host 0.0.0.0:5554
This, however, binds to all interfaces. I would prefer not to mess with ipchains/iptables, but force it to only bind on loopback. This would make it easier to manage from an automation of deployment perspective.