$targetId = $product->getId();
$updatedProduct = $this->serializer->deserialize( ... );
if(!$this->isValid($updatedProduct) || $targetId !== $updatedProduct->getId())
throw new BadRequestHttpException("Wrong product data");
$serializer->deserialize($data, 'Acme\Person', 'xml', array('object_to_populate' => $person));
Более-менее правильный способ...