You can change the location of the tmp directory by setting the jboss.server.temp.dir property. The best way to do that is to add "-Djboss.server.temp.dir=/some/path" to JAVA_OPTS in run.conf (or in run.bat for any Windows users who find this post later).
The work directory is set within Tomcat and for that one I am not so sure. You could try setting either the catalina.home or catalina.base system properties. If it works, the 'work' directory will be created in the directory specified by catalina.home or catalina.base.