When providing bulk power system services, a third-party aggregator could inadvertently cause operational issues at the distribution level. We propose a coordination architecture in which an aggregator and distribution operator coordinate to avoid distribution network constraint violations, while preserving private information. The aggregator controls thermostatic loads to provide frequency regulation, while the distribution operator overrides the aggregators control actions when necessary to ensure safe network operation. Using this architecture, we propose two control strategies, which differ in terms of measurement and communication requirements, as well as model complexity and scalability. The first uses an aggregate model and blocking controller, while the second uses individual load models and a mode-count controller. Both outperform a benchmark strategy in terms of tracking accuracy. Furthermore, the second strategy performs better than the first, with only 0.10% average RMS error (compared to 0.70%). The second is also able to maintain safe operation of the distribution network while overriding less than 1% of the aggregators control actions (compared to approximately 15% by the first strategy). However, the second strategy has significantly more measurement, communication, and computational requirements, and therefore would be more complex and expensive to implement than the first strategy.