How can I enforce data integrity in this model with a M:2 relationship?
You can add a "model" attribute to Transplantation and use it (in combination with the Donor and Receiver IDs) to create the 2 foreign keys.

If the "model" attribute is not part of Experimental Animal but of Used In, make the foreign keys target that relation.

In SQL terms that would be something like:

CREATE TABLE Transplantation
( DonorID
, ReceiverID
, ModelID
-- other attributes

-- primary key and other constraints    

, CONSTRAINT Donor_FK
    FOREIGN KEY (ModelID, DonorID)
    REFERENCES UsedIn                        -- UsedIn or ExperimentalAnimal
       (ModelID, ExperimentalAnimalID)       -- depending where the model 
, CONSTRAINT Receiver_FK                     -- attribute resides
    FOREIGN KEY (ModelID, ReceiverID)
    REFERENCES UsedIn                        -- same as above
      (ModelID, ExperimentalAnimalID)
, CONSTRAINT CommonSense_CK
    CHECK (DonorID &lt;&gt; ReceiverID)
) ;


The above FKs to be created, a UNIQUE constraint on UsedIn(ModelID, ExperimentalAnimalID) is required.