That's why server use a static suffix and do slaac to get their prefix. It's really as simple as that.
Regarding firewall policies:
just because most network OS are plain dumb, does not implies that's the fault of IPv6.
A zone based firewall solves that already.
And for instance OpenWrt fw4 can make rules for suffixes in a zone too.
