If you don't have a way to get a public address, IPv6 will be restricted to link local addresses. These are restricted to the local link, and should be slightly more secure than the private IPv4 ranges which can be routed within sites. The IPv6 equivalent is a site local address, but these are deprecated.
Firewall IPv6 with
ip6tables, just like you would IPv4 with
iptables. The Shorewall firewall tool can be configured to lock down IPv6, or its Shorewall6 version can be used to build an IPv6 firewall. IPv6 requires several more types than IPv4 to work correctly.
shorewall6 enables the minimal types for both when used with the example configurations. You have the option to enable additional types.
IPv6 does automatic configuration, so it is important to restrict incoming access if there is a risk that you may get a public address assigned. On the plus side, if the privacy extensions are enabled, your address will change every few hours, so your IPv6 address will only be vulnerable for a few hours before it replaced with a different address. People with access to your traffic would still be able to identify your address attempt to scan for open ports. The IPv6 address range on any network is huge, and it is not very practical to scan a network for hosts.