First off - why would anyone consider this a security risk? Apple's implementation of the WiFi password sharing feature is much better implemented than Microsoft's attempt from a while ago. For starters:
You can only share the password knowingly, and with someone you trust: You still receive a notification when your friend wants to connect to your network and also have to both press a button to accept the request and have them in your contact book.
The underlying principle of a pre-shared key remains the same: This isn't changing the functionality through which the client connects to the router (like with a RADIUS server in WPA2-Enterprise) but just removes the requirement for you to speak out the key. In fact, I'd even argue that this method is more secure as you said in another comment since there's no chance that someone you don't trust or an eavesdropper might be able to lift the note with the password or just record you shouting it out to your friend.
Additionally, in an enterprise, you should already be using WPA2-Enterprise with a RADIUS server instead of a PSK. This already seems like a flaw in your current implementation.
Finally, the implementation doesn't automatically share your password with every user in your contact book. It still makes you explicitly approve each user through a dialog box.
How could we switch this capability off?
It seems like an inbuilt feature without a way to turn it off. I'll update this answer if I come across anything in the future though.