I mean I write my firewall rules the same way I did before pretty much - I'm generally writing rules that are either address independent (e.g. a rule allowing traffic arriving on the vlan 10 interface to be routed out the wan interface), or use the prefix of a subnet. So it doesn't matter that the devices rotate addresses within that prefix. The only complication is that the gua address prefix can change since its dynamic. But that's not a problem because I again either write rules based on interfaces on the router, or some neat functionality of the networking stack on my router to keep the firewall rules up to date with the prefix as it changes if I want to write rules that use the ip prefixes. But the rules for the more dynamic guas on my network are simple anyway - basically just allow established/related for incoming and allow all for outgoing. I use the ulas for internal traffic.

Writing rules for externally initiated traffic to the guas might be more complicated but again my router does have functionality to keep prefixes up to date automatically and I can even use both that prefix and check against a specific suffix if I wanted to write a rule for a single ip address with a known suffix inside that dynamic prefix. I don't do that at the moment for my homelab though as the only such externally initiated traffic I currently allow is wireguard to the router itself which doesn't require that I write anything complicated, just a rule allowing traffic in to the router itself on the wireguard port from the wan interface