The main roles of the RA in IPv6 are to:
(1) exhibit the link-local gateway address of the sending router (this is not an RA option, and unlike v4, not a DHCPv6 option either)
(2) describe which prefixes are on-link; those will be resolved by clients using neighbor discovery, whereas all others will be forwarded to a gateway router.
The prefixes advertised by the router each have a flag bit indicating whether or not they are available for autoconfiguration. The RA also has global flag bits indicating whether or not the client should use DHCPv6; the M bit for managed addresses, and the O bit for other network configurations options. The usual combinations would be M-O- (no DHCP), M+O+ (full DHCP), or M-O+ (static DHCP, addresses are autoconfigured from the prefixes flagged as available). In practice most production network are running dual-stack with DHCPv4 and either static or SLAAC v6, partly because downlevel clients like windows XP and older OS-X either don't implement DHCPv6 at all, or get it wrong, not to mention the DHCPv6 problems in most consumer grade wifi gear.
The client controls whether it is doing static or dynamic addressing, and if dynamic how it picks its host part. EUI-64 mappings off the 48-bit ethernet MAC and privacy addresses are only two of its options; there are others.
In your case, I think you have to go with:
* router flags on-link prefixes as not available for autoconfiguration, tells clients to use managed addresses
* DHCPv6 server (not necessarily the router) hands out the v6 addresses you want
Most Cisco gear is willing to enforce EUI-64 mappings on host parts, if you want to be that draconian. Other v6 packets could get dropped.
-- Jim Leinweber, WI State Lab of Hygiene
