Given that blocking a single IPv6 address would seem to be somewhat pointless as an end user typically has at least 2**64 of them, we need to block a range, which identifies a "site".
A "site" in this context is something like a home or small office user. RFC 6177 discusses the allocation of address blocks to small sites:
... it might be tempting to give home sites a single /64, since that is already significantly more address space compared with today's IPv4 practice.
However, this precludes the expectation that even home sites will grow to support multiple subnets going forward. Hence, it is strongly intended that even home sites be given multiple subnets worth of space, by default. Hence, this document still recommends giving home sites significantly more than a single /64, but does not recommend that every home site be given a /48 either.
That said, I have read in online discussions that /64 and /56 are both common allocations for domestic users.
If I block a /64, and the attacker has a /56, then they have 255 more subnets to attack me from.
Conversely, if I block /56, and it turns out the ISP allocates blocks of /64, I might also have excluded 255 other users. Now the probability of you actually affecting your traffic by randomly excluding 255 sites is pretty low if you consider a random distribution. However, it is not, by definition random. It is feasible that I could in this sense block a small geographical area where my website is popular.
I use the example of blocking, but really it's a more general question, which extends to rate limiting, analytics etc.
In short, what is the best prefix size to identify a "site"? Are there any guidelines about this?