Energy Resources (DERs) can provide balancing services to the grid, but their power variations might cause voltage and current constraint violations in the distribution network, compromising network safety. This could be avoided by including network constraints within DER control formulations, but the entities coordinating DERs (e.g., aggregators) may not have access to network information, which typically is known only to the utility. Therefore, it is challenging to develop network-safe DER control algorithms when the aggregator is not the utility; it requires these entities to coordinate with each other. In this paper, we develop an aggregator-utility coordination framework that enables network-safe control of thermostatically-controlled loads to provide frequency regulation. In our framework, the utility sends a network-safe constraint set on the aggregator's command without directly sharing any network information. We propose a constraint set construction algorithm that guarantees satisfaction of a chance constraint on network safety. Assuming monotonicity of the probability of network safety with respect to the aggregator's command, we leverage the bisection method to find the largest possible constraint set, providing maximum flexibility to the aggregator. Simulations show that, compared to two benchmark algorithms, the proposed approach provides a good balance between service quality and network safety.