Routable IPs aren't the problem here. In fact under IPv6 you generally would give devices routable IPs. NAT is not a security mechanism.

Instead, you should put a default-deny rule on your firewall for all incoming traffic to user devices (which is generally the default setting anyway).