With IPv6, how to get both GUA SLAAC and a single ULA DHCPv6 address?

[espenu]

In all my VLANs my clients currently get a GUA address using SLAAC.
But for internal server communications I don't want to risk a prefix change from my ISP to break internal communications.
So, I've settled on using DHCPv6 to give out ULA addresses. Each server is given a dedicated address added to its host entry in dnsmasq.
Opnsense is given a ULA in each subnet as a virtual IP on each interface. In Router Advertisements the mode is set to assisted.
This partially works, as the clients get both a SLAAC GUA and the DHCPv6 ULA. However, since it's not possible to set RA modes per address, only per interface, I also get a ULA SLAAC address.
The extra address wouldn't have been a big deal if it wasn't for the fact that the servers use the ULA SLAAC as their source address when communicating across VLANs.
Because of that, my firewall rules, which rely on the hostname entries, kind of break.

The only "solutions" I've found are:
- Use the ULA SLAAC for source in firewall rules, but this is messy and the SLAAC may be using privacy extensions so the address is not deterministic (which is why I wanted DHCPv6 in the first place).
Disabling privacy extensions also makes the GUA EUI-64 and therefore exposes the MAC (not a deadly critical issue, but I want to avoid it). It also requires custom configuration depending on server OS, which I don't like.

- Use the whole network prefix as the source in firewall rules. This is what I currently do, but it makes my rules much "looser" than I would like.

The best solution would be if I could only set the RA A flag to only be used for the GUA prefix. But as I understand it that's not possible in Opnsense because settings apply to all addresses on the selected interface.
Or are there ways to do this that I just haven't found?
The "for all addresses in the interface" approach is also annoying with DHCPv6, because if I use the constructor and only specify the end addresses for the range, it will give out DHCPv6 for both GUA and ULA, when I only want the ULA. Specifying the whole range addresses solves this of course, but it's still a bit annoying.

Are there solutions to this issue? Am I just thinking about the whole thing in the wrong way?

[Bob.Dig]

Why not using good, old IPv4 for internal things?

[dseven]

A possible alternative would be to use ULA only for internal, and NPTv6 for internet...

[meyergru]

Why not using good, old IPv4 for internal things?

I am also fond of that, see: https://forum.opnsense.org/index.php?topic=45822.0 for an in-depth discussion.