How to set up a firewall between vlan with ipv6?

Question

network hardware

Good afternoon.
I continue to study ipv6. A multi-subnet network is up and running. From the Internet, I opened access to several services via ipv6, for the time being for the test.
From the Internet, everything superfluous is blocked, but what is the best way to separate internal subnets?
In ipv4, it was divided by masks. Everything is closed, you can only go where you are allowed. You need an Internet, you can connect to !192.168.0.0/16 (everyone who is not from LAN) or to the neighboring network 192.168.20.0/24.
In ipv6, there is only one idea so far: allow everything and block ipv6 a range of global addresses from another subnet where you can’t go, but this is somehow not right.
Maybe there are some options to make the rules more beautiful?