IPv6 rules to allow only access to one device ipv6

Hello I have a glinet router in cascade with a fritzbox that receive ipv6 and server glinet lan with ipv6 relay.

Now any ipv6 device is directly exposed on the internet… but i wan to manually set wich device can be exposed (like the fritzbox allow to do).

How to do this with glinet?