I wrote a whitepaper on this many years ago, and it is still valid: https://labs.ripe.net/Members/steffann/preparing-an-ipv6-addressing-plan
To directly answer your questions: these days I usually reserve a /64 for each point to point link, but I configure it as a /127 using the
xyz::b addresses. That makes it easier to talk about the link (
a side and
b side) and it allows you to change it to anything you'd like in the future if you change your mind.
Using private (a.k.a. ULA) addresses internally is often causing problems. If a router sources an ICMP error from such an address it will be filtered on the internet, and error messages that don't arrive cause black holes. Much better to use public addresses everywhere.
If you want to protect your infrastructure set aside a block from your public space for loopback, point to point and other infra, and put a simple ACL on your edge routers to drop incoming traffic to those addresses. Outbound errors will go out, but incoming traffic can't attack your infra. At least not directly, which is the same protection that using ULA would give you, but without the headaches.