Ramu,
provided that whatever suggestion anybody could provide who has to live with the consequence is who implements it .... I would say the decision is yours.
My toughts on this are:
-execute a risk assessment and evaluate the trustiness of your inside users: if they are not security savy or untrusty I would roll out the safest possible network;
-establish a good security policy and acceptable usage policy and bind all users to it (approved by top layer management) so you can restrict usage to an acceptable (from security stand point) level and disciplinate abuses;
My raccomandation is go with the /64 if you can and use the /120 if you must. This is because things like autoconfiguration works if you keep the /64 (48 bits MAC and 16 bits in the middle).
You can defend at the perimeter by filtering any address not aimed to a visible/accessible from outside server and you can confine them to a /120 from an access list point of view wile still using a /64 on their subnet. Clients wil access the Internet through CBAC or reflexive access lists so to punch holes only when connection is established from inside.
Even better, since ipsec is part of IPv6 therefore remote enterprise users will be able to be part of the inside network even when remotely connected without security degradation and access servers that will not need to be made available from the outside.
I understand you are just putting together a test network, but if the aim is to get ready to deploy ipv6 try to establish policies first and configure/design afterward. I saw way to many network built putting together equipment an then to be secured with inadequate design. (I have long since left the wiring closet and I now deal with the policy making bit).
Cheers
Fabio
