Yeah, that's one of the known issues with IPv6. You can still use a NAT or better yet a firewall that blocks all direct traffic between the internet and internal nodes. You can also do things like assigning nodes a new IPv6 adress every 24h.