You should be able to avoid this problem as follows: Immediately outside the door, create a short corridor along the wall that the door is embedded in. The corridor should be at least 3 blocks long and can extend in either direction, or both directions if you like. On each block within the corridor, place a button. Make sure that when the door is open, every floor block that can be seen from a villager's perspective has a button on it. The following screenshots show what I mean:
The reason this works is that villagers cannot pathfind over or through a block with a button in it. What's happening is that when a player opens an iron door, nearby villagers can see surface blocks outside the door. If a villager is looking at the player (which they do all the time, to signal their willingness to trade when they're close by) and happens to also be looking for somewhere to wander to, there's a high probability it will choose a block outside the door as its target. Once that happens, it will start pathfinding toward that block, and it will open and close any doors it encounters on the way. (The bug is that it shouldn't be able to open an iron door, but opening wooden doors is intended behavior.) But a villager can't target a block with a button on it, so this technique ensures it never chooses a target block outside the door. In fact, you wouldn't even need the door any more, except that crowded villagers can nudge each other onto a block with a button in it, and they could eventually escape that way or become stuck there.