If you give your customers a single /128, you're forcing *them* to use NAT. This is bad.
Probably the simplest way will be subnet /64 or smaller, where part of IP will be MAC address of enduser.
The strong recommendation is to give your customers something between a /48 and a /64. NO LESS, unless you know for sure(!) that they only have a single machine, and no network behind it.
ok, I understand the concept.. still have to wait for proper BRAS and CPE implementations... And I understand, that i.e. /64 for subscribers network is something that in IPv4 PI world would be forbidden (i.e. /29). If all of us agree, that there is enough address space for every toothbrush, subscribers can get something between /48 an /64 and this is will be usual, and even in IPv6 PA space there will be no every subnet registration (as I understand, and as it is requiured for IPv4 PA) - why IPv6 PI can not be similar to IPv6 PA then ??? Regards, Marcin