[tedreed]

So you block the /64. There aren't any subnets smaller than a /64 in IPv6, so you're guaranteed to be blocking a leaf node.

This is still miles better than having all of the customers behind large scale NAT, where you risk blocking innocent folks who happen to be behind the same NAT.